Windows Analysis Report
Lg3gn9y1Cj.exe

Overview

General Information

Sample Name: Lg3gn9y1Cj.exe
Analysis ID: 679096
MD5: 45061e4da841c2587d0890148705a142
SHA1: eb68218c1d70f3ba00f8190c8171ad1cfa2fb42a
SHA256: 6731f235ff78e22e5a0f1503542926bb707a95251b8cbd22c56fbd7fc5a8cbbf
Tags: exeMassLogger
Infos:

Detection

CryptOne, BluStealer, StormKitty
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Potential malicious icon found
Yara detected BluStealer
System process connects to network (likely due to code injection or exploit)
Detected CryptOne packer
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Antivirus / Scanner detection for submitted sample
Yara detected StormKitty Stealer
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
PE file has a writeable .text section
Machine Learning detection for sample
Allocates memory in foreign processes
May check the online IP address of the machine
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Drops executables to the windows directory (C:\Windows) and starts them
Uses schtasks.exe or at.exe to add and modify task schedules
Drops PE files with benign system names
Tries to harvest and steal browser information (history, passwords, etc)
Installs a global keyboard hook
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Changes security center settings (notifications, updates, antivirus, firewall)
Yara detected Generic Downloader
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Modifies existing windows services
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Deletes files inside the Windows folder
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Queries information about the installed CPU (vendor, model number etc)
AV process strings found (often used to terminate AV products)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Installs a global mouse hook
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Windows\System\svchost.exe Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\spoolsv.exe Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Roaming\mrsys.exe Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\explorer.exe Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Local\stsys.exe Avira: detection malicious, Label: TR/Patched.Ren.Gen
Multi AV Scanner detection for submitted file
Source: Lg3gn9y1Cj.exe Virustotal: Detection: 87% Perma Link
Source: Lg3gn9y1Cj.exe ReversingLabs: Detection: 100%
Antivirus / Scanner detection for submitted sample
Source: Lg3gn9y1Cj.exe Avira: detected
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Metadefender: Detection: 25% Perma Link
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe ReversingLabs: Detection: 92%
Machine Learning detection for sample
Source: Lg3gn9y1Cj.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Joe Sandbox ML: detected
Source: C:\Windows\System\svchost.exe Joe Sandbox ML: detected
Source: C:\Windows\System\spoolsv.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\mrsys.exe Joe Sandbox ML: detected
Source: C:\Windows\System\explorer.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\stsys.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 9.0.spoolsv.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 52.2.svchost.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.lg3gn9y1cj.exe .400000.0.unpack Avira: Label: TR/Dropper.Gen
Source: 9.2.spoolsv.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.lg3gn9y1cj.exe .400000.0.unpack Avira: Label: TR/Dropper.Gen
Source: 7.2.spoolsv.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 34.2.explorer.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 4.0.icsys.icn.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 4.2.icsys.icn.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Lg3gn9y1Cj.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 52.0.svchost.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 5.2.explorer.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 5.0.explorer.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.svchost.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.0.Lg3gn9y1Cj.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 34.0.explorer.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 8.0.svchost.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.spoolsv.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Uses 32bit PE files
Source: Lg3gn9y1Cj.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 51.81.194.202:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: Binary string: C:\Users\KINGDOM\Documents\New Builder\Linq4you\Linq4you\obj\x86\Release\Linq4me.pdb source: lg3gn9y1cj.exe , lg3gn9y1cj.exe , 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, lg3gn9y1cj.exe , 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: WaaSMedicSvc.pdb source: waasmedic.20220805_070938_705.etl.45.dr
Source: Binary string: C:\Users\KINGDOM\Documents\New Builder\Linq4you\Linq4you\obj\x86\Release\Linq4me.pdbDO source: lg3gn9y1cj.exe , 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, lg3gn9y1cj.exe , 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_00417143
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_00416130
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_004171D7
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_004179F2
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_00417190
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_0041725A
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 4x nop then push ebp 0_2_004172E5

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System\explorer.exe Domain query: vccmd01.googlecode.com
Source: C:\Windows\System\explorer.exe Domain query: vccmd02.googlecode.com
Source: C:\Windows\System\explorer.exe Network Connect: 51.81.194.202 443 Jump to behavior
Source: C:\Windows\System\explorer.exe Domain query: zxq.net
Source: C:\Windows\System\explorer.exe Domain query: vccmd01.zxq.net
Source: C:\Windows\System\explorer.exe Domain query: vccmd03.googlecode.com
Source: C:\Windows\System\explorer.exe Domain query: vccmd01.t35.com
Source: C:\Windows\System\explorer.exe Network Connect: 142.250.145.82 80 Jump to behavior
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe DNS query: name: icanhazip.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe DNS query: name: icanhazip.com
Yara detected Generic Downloader
Source: Yara match File source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 57f3642b4e37e28f5cbe3020c9331b4c
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /what-happened-to-the-old-zxq-website/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.114.97 104.18.114.97
Source: svchost.exe, 00000027.00000002.537976090.000001E1CF665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000027.00000002.537391592.000001E1CF612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: AppLaunch.exe, 00000002.00000002.277628269.00000000072E5000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.277032970.0000000007221000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.277673083.00000000072F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://icanhazip.com
Source: AppLaunch.exe, 00000002.00000002.277628269.00000000072E5000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.277032970.0000000007221000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://icanhazip.com/
Source: AppLaunch.exe, 00000002.00000002.277665850.00000000072EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://icanhazip.com4
Source: AppLaunch.exe, 00000002.00000002.277628269.00000000072E5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 00000020.00000002.339302995.000001401B813000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000016.00000002.532432595.0000018D6C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000016.00000002.532432595.0000018D6C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000016.00000002.532432595.0000018D6C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com
Source: lg3gn9y1cj.exe , lg3gn9y1cj.exe , 00000001.00000002.528409980.0000000000401000.00000020.00000001.01000000.00000006.sdmp, lg3gn9y1cj.exe , 00000001.00000000.260922909.0000000000401000.00000020.00000001.01000000.00000006.sdmp, lg3gn9y1cj.exe , 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, lg3gn9y1cj.exe , 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, Lg3gn9y1Cj.exe, lg3gn9y1cj.exe .0.dr String found in binary or memory: https://api.telegram.org/bot
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://api.w.org/
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000016.00000002.532432595.0000018D6C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000016.00000002.532432595.0000018D6C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000020.00000003.337483539.000001401B85A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000020.00000002.340148688.000001401B83C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000020.00000002.340646208.000001401B84D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337643299.000001401B840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337917326.000001401B846000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000020.00000002.340148688.000001401B83C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000020.00000003.337643299.000001401B840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.340255237.000001401B842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.338015519.000001401B841000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000020.00000003.337643299.000001401B840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.340255237.000001401B842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.338015519.000001401B841000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000020.00000003.337643299.000001401B840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.340715628.000001401B85C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337483539.000001401B85A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000020.00000003.337483539.000001401B85A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000020.00000003.337483539.000001401B85A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000020.00000002.340715628.000001401B85C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337483539.000001401B85A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000020.00000003.337301947.000001401B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337483539.000001401B85A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.338015519.000001401B841000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000020.00000003.337412785.000001401B861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000020.00000002.340148688.000001401B83C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000020.00000003.313688080.000001401B831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://fonts.googleapis.com/css?family=DM
Source: AppLaunch.exe, 00000002.00000002.277032970.0000000007221000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://news.google.com/publications/CAAqBwgKMJSRswswoazKAw?hl=en-US&gl=US&ceid=US%3Aen
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.537973119.0000000003B35000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://schema.org
Source: svchost.exe, 00000020.00000002.340148688.000001401B83C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000020.00000002.339302995.000001401B813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.340148688.000001401B83C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000020.00000003.337977205.000001401B856000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000020.00000003.337977205.000001401B856000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000020.00000003.313688080.000001401B831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000020.00000002.340065799.000001401B83A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.313688080.000001401B831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000020.00000002.340646208.000001401B84D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337643299.000001401B840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.337917326.000001401B846000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.411158230.0000000003B24000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.408331910.0000000003B24000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.537924053.0000000003B20000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.537973119.0000000003B35000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.374604090.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.411195559.0000000003B35000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://yoast.com/wordpress/plugins/seo/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/#logo
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/#organization
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/#website
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/?p=187
Source: explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/?s=
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/about-us/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/best-mothers-day-gifts-of-2022-for-every-mom/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/contact-us/
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/feed/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/how-to-find-an-investor-for-your-business/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/news/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/news/business/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/news/entertainment/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/news/science-health/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/news/technology/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/online-shopping-tips-during-covid/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/privacy-policy/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/reasons-to-hire-a-truck-accident-attorney/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/the-future-of-cryptocurrency-is-it-time-to-get-your-crypto-license-in-europe/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/these-are-the-injured-you-may-suffer-in-a-bicycle-accident/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb
Source: explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#webpage
Source: explorer.exe, 00000005.00000002.537973119.0000000003B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/;
Source: explorer.exe, 00000005.00000002.537973119.0000000003B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/L
Source: explorer.exe, 00000005.00000002.537973119.0000000003B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/n
Source: explorer.exe, 00000005.00000002.537973119.0000000003B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/ne
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/what-is-the-best-way-to-learn-golang/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/why-you-should-seek-an-uber-or-lyft-accident-lawyer/
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106
Source: explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.411195559.0000000003B35000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/icons/icons.css?ver=7.1.1
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/lightbox.css?ver=7.1.1
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/jquery.mfp-lightbox.js?ver=7.1.1
Source: explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/jquery.sticky-sidebar.js?ver=7.1.1
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/lazyload.js?ver=7.1.1
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/theme.js?ver=7.1.1
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/style.css?ver=7.1.1
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/ZXQ.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/zxq-icon-150x150.png
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/zxq-icon-300x300.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-150x58.png
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-300x117.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-450x175.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Best-Mothers-Day-Gifts-of-2022-for-Every-Mom-01-1024x576.
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Best-Mothers-Day-Gifts-of-2022-for-Every-Mom-01-150x84.jp
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Best-Mothers-Day-Gifts-of-2022-for-Every-Mom-01-300x169.j
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Best-Mothers-Day-Gifts-of-2022-for-Every-Mom-01-450x253.j
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Best-Mothers-Day-Gifts-of-2022-for-Every-Mom-01-768x432.j
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Best-Mothers-Day-Gifts-of-2022-for-Every-Mom-01.jpg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To--1024x609.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To--1200x714.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To--150x89.png
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To--300x179.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To--450x268.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To--768x457.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/How-To-.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Online-Shopping-Tips-During-Covid-01-1024x576.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Online-Shopping-Tips-During-Covid-01-150x84.jpeg
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Online-Shopping-Tips-During-Covid-01-300x169.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Online-Shopping-Tips-During-Covid-01-450x253.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Online-Shopping-Tips-During-Covid-01-768x432.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Online-Shopping-Tips-During-Covid-01.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Reasons-to-Hire-a-Truck-Accident-Attorney-01-1024x576.jpe
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Reasons-to-Hire-a-Truck-Accident-Attorney-01-150x84.jpeg
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Reasons-to-Hire-a-Truck-Accident-Attorney-01-300x169.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Reasons-to-Hire-a-Truck-Accident-Attorney-01-450x253.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Reasons-to-Hire-a-Truck-Accident-Attorney-01-768x432.jpeg
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Reasons-to-Hire-a-Truck-Accident-Attorney-01.jpeg
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/The-Future-of-Cryptocurrency-Is-it-Time-to-Get-Your-Crypt
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/These-Are-The-Injured-You-May-Suffer-in-a-Bicycle-Acciden
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-1024x637.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-1200x747.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-150x93.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-1536x956.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-2048x1274.png
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-300x187.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-450x280.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/What-is-the-Best-Way-to-Learn-Golang-768x478.png
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Why-You-Should-Seek-An-Uber-Or-Lyft-Accident-Lawyer-01-10
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Why-You-Should-Seek-An-Uber-Or-Lyft-Accident-Lawyer-01-15
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Why-You-Should-Seek-An-Uber-Or-Lyft-Accident-Lawyer-01-30
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Why-You-Should-Seek-An-Uber-Or-Lyft-Accident-Lawyer-01-45
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Why-You-Should-Seek-An-Uber-Or-Lyft-Accident-Lawyer-01-76
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.337297943.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-content/uploads/2022/07/Why-You-Should-Seek-An-Uber-Or-Lyft-Accident-Lawyer-01.jp
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-includes/css/dist/block-library/style.min.css?ver=5.9.1
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-includes/wlwmanifest.xml
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-json/
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fzxq.net%2Fwhat-happened-to-the-old-zxq-we
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/wp-json/wp/v2/pages/187
Source: what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/write-for-us/
Source: explorer.exe, 00000005.00000003.444428026.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.339157472.0000000003B22000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414179479.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375591680.0000000003B42000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414485795.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.443490595.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.508841852.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.414107103.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.376094580.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.476931676.0000000003B3B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.375713725.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.410951978.0000000003B36000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.367687421.0000000003B26000.00000004.00000800.00020000.00000000.sdmp, cmsys.cmn.5.dr, what-happened-to-the-old-zxq-website[1].htm.5.dr String found in binary or memory: https://zxq.net/xmlrpc.php?rsd
Source: unknown DNS traffic detected: queries for: 64.89.4.0.in-addr.arpa
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /what-happened-to-the-old-zxq-website/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:09:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:09:30 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:09:33 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:09:49 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:09:51 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:09:54 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:06 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:10 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:12 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:23 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:26 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:40 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:42 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:44 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:53 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:57 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:10:59 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:11:08 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Fri, 05 Aug 2022 07:11:10 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: unknown HTTPS traffic detected: 51.81.194.202:443 -> 192.168.2.4:49766 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Windows user hook set: 916 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Windows user hook set: 1792 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL Jump to behavior
Source: C:\Windows\System\explorer.exe Windows user hook set: 5244 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL Jump to behavior
Source: C:\Windows\System\explorer.exe Windows user hook set: 0 keyboard low level c:\windows\system\explorer.exe Jump to behavior
Source: C:\Windows\System\explorer.exe Windows user hook set: 0 mouse low level c:\windows\system\explorer.exe Jump to behavior
Source: C:\Windows\System\spoolsv.exe Windows user hook set: 3472 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL Jump to behavior
Source: C:\Windows\System\svchost.exe Windows user hook set: 784 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Source: C:\Windows\System\spoolsv.exe Windows user hook set: 4736 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Source: C:\Windows\System\explorer.exe Windows user hook set: 5540 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Source: C:\Windows\System\svchost.exe Windows user hook set: 6312 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Creates a DirectInput object (often for capturing keystrokes)
Source: Lg3gn9y1Cj.exe, 00000000.00000002.270751235.000000000075A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Installs a global mouse hook
Source: C:\Windows\System\explorer.exe Windows user hook set: 0 mouse low level c:\windows\system\explorer.exe Jump to behavior

System Summary
barindex
Potential malicious icon found
Source: initial sample Icon embedded in PE file: bad icon match: 20047c7c70f0e004
Malicious sample detected (through community Yara rule)
Source: Lg3gn9y1Cj.exe, type: SAMPLE Matched rule: Detects A310Logger Author: ditekSHen
Source: 1.0.lg3gn9y1cj.exe .400000.0.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 1.2.lg3gn9y1cj.exe .400000.0.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe , type: DROPPED Matched rule: Detects A310Logger Author: ditekSHen
PE file has a writeable .text section
Source: Lg3gn9y1Cj.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: icsys.icn.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: explorer.exe.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: spoolsv.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mrsys.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: svchost.exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: stsys.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Detected potential crypto function
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 0_2_0041F830 0_2_0041F830
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 0_2_00416130 0_2_00416130
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 0_2_00422F50 0_2_00422F50
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Code function: 1_2_004019AC 1_2_004019AC
PE file contains strange resources
Source: lg3gn9y1cj.exe .0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\System\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System\explorer.exe Section loaded: tokenbinding.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: drprov.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: ntlanman.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: davclnt.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: browcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cdpsgshims.dll
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Desktop\lg3gn9y1cj.exe 8A1902D9C0DBE388B28EF5A9C8EC4C0F1802FC6CCD43471EA337DCB3D71C81D4
Uses 32bit PE files
Source: Lg3gn9y1Cj.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: Lg3gn9y1Cj.exe, type: SAMPLE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 1.0.lg3gn9y1cj.exe .400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 1.2.lg3gn9y1cj.exe .400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe , type: DROPPED Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Deletes files inside the Windows folder
Source: C:\Users\user\AppData\Local\icsys.icn.exe File deleted: C:\Windows\System\explorer.exe Jump to behavior
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\icsys.icn.exe File created: c:\windows\system\explorer.exe Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Code function: String function: 004017F0 appears 49 times
Sample file is different than original file name gathered from version info
Source: Lg3gn9y1Cj.exe, 00000000.00000002.270646029.000000000042E000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWin.exe vs Lg3gn9y1Cj.exe
Source: Lg3gn9y1Cj.exe, 00000000.00000003.269756688.00000000007A3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoral.exe vs Lg3gn9y1Cj.exe
Source: Lg3gn9y1Cj.exe Binary or memory string: OriginalFilenameWin.exe vs Lg3gn9y1Cj.exe
Source: Lg3gn9y1Cj.exe Binary or memory string: OriginalFilenamesoral.exe vs Lg3gn9y1Cj.exe
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Windows\System\explorer.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Windows\System\spoolsv.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Windows\System\svchost.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Windows\System\spoolsv.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll
Source: C:\Windows\System\explorer.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll
Source: C:\Windows\System\svchost.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File created: C:\Users\user\AppData\Local\icsys.icn.exe Jump to behavior
Source: classification engine Classification label: mal100.rans.troj.spyw.evad.winEXE@144/20@13/5
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File read: C:\Users\desktop.ini Jump to behavior
Source: lg3gn9y1cj.exe , 00000001.00000002.529257275.000000000041F000.00000004.00000001.01000000.00000006.sdmp Binary or memory string: \gA*\AC:\Users\TTDOCKYARD\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: Lg3gn9y1Cj.exe, 00000000.00000002.270634178.000000000042C000.00000004.00000001.01000000.00000003.sdmp, icsys.icn.exe, 00000004.00000002.284335870.000000000042C000.00000004.00000001.01000000.0000000A.sdmp, spoolsv.exe, 00000007.00000002.281046560.000000000042C000.00000004.00000001.01000000.0000000C.sdmp, spoolsv.exe, 00000009.00000002.280212029.000000000042C000.00000004.00000001.01000000.0000000C.sdmp, explorer.exe, 00000022.00000002.316774261.000000000042C000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 00000034.00000002.341661053.000000000042C000.00000004.00000001.01000000.0000000D.sdmp Binary or memory string: f`P@*\AD:\Code\Explorer\Explorer.vbp
Source: Lg3gn9y1Cj.exe, icsys.icn.exe.0.dr, svchost.exe.7.dr, spoolsv.exe.5.dr, mrsys.exe.5.dr, explorer.exe.4.dr, stsys.exe.8.dr Binary or memory string: B*\AD:\Code\Explorer\Explorer.vbp
Source: explorer.exe, 00000005.00000002.529162179.000000000042C000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.528806074.000000000042C000.00000004.00000001.01000000.0000000D.sdmp Binary or memory string: `P@*\AD:\Code\Explorer\Explorer.vbp
Source: lg3gn9y1cj.exe , 00000001.00000002.528409980.0000000000401000.00000020.00000001.01000000.00000006.sdmp, lg3gn9y1cj.exe , 00000001.00000000.260922909.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Lg3gn9y1Cj.exe, lg3gn9y1cj.exe .0.dr Binary or memory string: A*\AC:\Users\TTDOCKYARD\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp<aA
Source: lg3gn9y1cj.exe Binary or memory string: A*\AC:\Users\TTDOCKYARD\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: Lg3gn9y1Cj.exe Virustotal: Detection: 87%
Source: Lg3gn9y1Cj.exe ReversingLabs: Detection: 100%
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File read: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Lg3gn9y1Cj.exe "C:\Users\user\Desktop\Lg3gn9y1Cj.exe"
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process created: C:\Users\user\Desktop\lg3gn9y1cj.exe c:\users\user\desktop\lg3gn9y1cj.exe
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process created: C:\Users\user\AppData\Local\icsys.icn.exe C:\Users\user\AppData\Local\icsys.icn.exe
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process created: C:\Windows\System\explorer.exe c:\windows\system\explorer.exe
Source: C:\Windows\System\explorer.exe Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe SE
Source: C:\Windows\System\spoolsv.exe Process created: C:\Windows\System\svchost.exe c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe PR
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: unknown Process created: C:\Windows\System\explorer.exe "C:\windows\system\explorer.exe" RO
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System\svchost.exe "C:\windows\system\svchost.exe" RO
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess
Source: C:\Windows\SysWOW64\at.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\sc.exe sc config Schedule start= auto
Source: C:\Windows\SysWOW64\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process created: C:\Users\user\Desktop\lg3gn9y1cj.exe c:\users\user\desktop\lg3gn9y1cj.exe Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process created: C:\Users\user\AppData\Local\icsys.icn.exe C:\Users\user\AppData\Local\icsys.icn.exe Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process created: C:\Windows\System\explorer.exe c:\windows\system\explorer.exe Jump to behavior
Source: C:\Windows\System\explorer.exe Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe SE Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process created: C:\Windows\System\svchost.exe c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe PR Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\sc.exe sc config Schedule start= auto Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File created: C:\Users\user\AppData\Local\Temp\~DF01383C41703FF854.TMP Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:380:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4764:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1560:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5752:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5500:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3856:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4316:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:240:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3340:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5132:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_01
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process created: C:\Windows\System\explorer.exe
Source: unknown Process created: C:\Windows\System\explorer.exe
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process created: C:\Windows\System\explorer.exe Jump to behavior
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, Linq4you/FileZilla.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, Linq4you/SystemInfo.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, ThunderFox/MozillaTFOXPBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.0.AppLaunch.exe.5320000.0.unpack, Linq4you/FileZilla.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.0.AppLaunch.exe.5320000.0.unpack, Linq4you/SystemInfo.cs Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.AppLaunch.exe.5320000.0.unpack, ThunderFox/MozillaTFOXPBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Binary string: C:\Users\KINGDOM\Documents\New Builder\Linq4you\Linq4you\obj\x86\Release\Linq4me.pdb source: lg3gn9y1cj.exe , lg3gn9y1cj.exe , 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, lg3gn9y1cj.exe , 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: WaaSMedicSvc.pdb source: waasmedic.20220805_070938_705.etl.45.dr
Source: Binary string: C:\Users\KINGDOM\Documents\New Builder\Linq4you\Linq4you\obj\x86\Release\Linq4me.pdbDO source: lg3gn9y1cj.exe , 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, lg3gn9y1cj.exe , 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected CryptOne packer
Source: C:\Windows\System\svchost.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B196B287-BAB4-101A-B69C-00AA00341D07}\ProxyStubClsid32 Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Code function: 1_2_0040B64D push cs; ret 1_2_0040B6F9
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Code function: 1_2_0040AE9E push ds; ret 1_2_0040B5EB
PE file contains sections with non-standard names
Source: Lg3gn9y1Cj.exe Static PE information: section name: .tdata
Source: icsys.icn.exe.0.dr Static PE information: section name: .tdata
Source: explorer.exe.4.dr Static PE information: section name: .tdata
Source: spoolsv.exe.5.dr Static PE information: section name: .tdata
Source: mrsys.exe.5.dr Static PE information: section name: .tdata
Source: svchost.exe.7.dr Static PE information: section name: .tdata
Source: stsys.exe.8.dr Static PE information: section name: .tdata

Persistence and Installation Behavior
barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\System\svchost.exe Executable created and started: c:\windows\system\spoolsv.exe Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Executable created and started: c:\windows\system\explorer.exe Jump to behavior
Source: C:\Windows\System\spoolsv.exe Executable created and started: c:\windows\system\svchost.exe Jump to behavior
Drops PE files with benign system names
Source: C:\Windows\System\spoolsv.exe File created: C:\Windows\System\svchost.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe File created: C:\Windows\System\explorer.exe Jump to dropped file
Source: C:\Windows\System\explorer.exe File created: C:\Windows\System\spoolsv.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File created: C:\Users\user\Desktop\lg3gn9y1cj.exe Jump to dropped file
Drops PE files
Source: C:\Windows\System\spoolsv.exe File created: C:\Windows\System\svchost.exe Jump to dropped file
Source: C:\Windows\System\explorer.exe File created: C:\Users\user\AppData\Roaming\mrsys.exe Jump to dropped file
Source: C:\Windows\System\svchost.exe File created: C:\Users\user\AppData\Local\stsys.exe Jump to dropped file
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File created: C:\Users\user\Desktop\lg3gn9y1cj.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe File created: C:\Windows\System\explorer.exe Jump to dropped file
Source: C:\Windows\System\explorer.exe File created: C:\Windows\System\spoolsv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe File created: C:\Users\user\AppData\Local\icsys.icn.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System\spoolsv.exe File created: C:\Windows\System\svchost.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe File created: C:\Windows\System\explorer.exe Jump to dropped file
Source: C:\Windows\System\explorer.exe File created: C:\Windows\System\spoolsv.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\at.exe at 09:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Creates an undocumented autostart registry key
Source: C:\Windows\System\explorer.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath Jump to behavior
Modifies existing windows services
Source: C:\Windows\System\svchost.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess Jump to behavior
Source: C:\Windows\System\svchost.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System\spoolsv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe TID: 916 Thread sleep count: 33 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 5140 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 1404 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System\explorer.exe TID: 5244 Thread sleep count: 359 > 30 Jump to behavior
Source: C:\Windows\System\svchost.exe TID: 784 Thread sleep count: 66 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4216 Thread sleep time: -30000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System\explorer.exe Window / User API: threadDelayed 359 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe API coverage: 3.2 %
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\mrsys.exe Jump to dropped file
Source: C:\Windows\System\svchost.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\stsys.exe Jump to dropped file
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: svchost.exe, 00000027.00000002.537976090.000001E1CF665000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.529653388.0000024224802000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000027.00000002.532624727.000001E1CA029000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.537883758.000001E1CF658000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.531319269.0000024224840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.532432595.0000018D6C440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.532026229.0000018338C29000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\icsys.icn.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System\explorer.exe Domain query: vccmd01.googlecode.com
Source: C:\Windows\System\explorer.exe Domain query: vccmd02.googlecode.com
Source: C:\Windows\System\explorer.exe Network Connect: 51.81.194.202 443 Jump to behavior
Source: C:\Windows\System\explorer.exe Domain query: zxq.net
Source: C:\Windows\System\explorer.exe Domain query: vccmd01.zxq.net
Source: C:\Windows\System\explorer.exe Domain query: vccmd03.googlecode.com
Source: C:\Windows\System\explorer.exe Domain query: vccmd01.t35.com
Source: C:\Windows\System\explorer.exe Network Connect: 142.250.145.82 80 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 5320000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 5320000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 5320000 Jump to behavior
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 503F008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\lg3gn9y1cj.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\Lg3gn9y1Cj.exe Code function: 0_2_0041E9D0 __vbaChkstk,__vbaOnError,#525,__vbaStrMove,__vbaLenBstr,__vbaStrToAnsi,GetUserNameA,__vbaStrToUnicode,__vbaFreeStr,#537,__vbaStrMove,__vbaInStr,#616,__vbaStrMove,__vbaFreeStr,__vbaFreeStr,__vbaErrorOverflow, 0_2_0041E9D0

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 0000002E.00000002.532484937.000001B3C3F02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information
barindex
Yara detected BluStealer
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 5840, type: MEMORYSTR
Yara detected StormKitty Stealer
Source: Yara match File source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 5840, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.277724010.000000000733B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.277673083.00000000072F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 5840, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected BluStealer
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 5840, type: MEMORYSTR
Yara detected StormKitty Stealer
Source: Yara match File source: 1.2.lg3gn9y1cj.exe .2b40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AppLaunch.exe.5320000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.265995360.0000000005322000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.535235845.0000000002B42000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.266417604.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lg3gn9y1cj.exe PID: 4392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 5840, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 679096 Sample: Lg3gn9y1Cj.exe Startdate: 05/08/2022 Architecture: WINDOWS Score: 100 93 Potential malicious icon found 2->93 95 Malicious sample detected (through community Yara rule) 2->95 97 Antivirus detection for dropped file 2->97 99 10 other signatures 2->99 11 Lg3gn9y1Cj.exe 1 4 2->11         started        15 explorer.exe 2->15         started        17 svchost.exe 2->17         started        19 8 other processes 2->19 process3 dnsIp4 71 C:\Users\user\Desktop\lg3gn9y1cj.exe, PE32 11->71 dropped 73 C:\Users\user\AppData\Local\icsys.icn.exe, PE32 11->73 dropped 131 Installs a global keyboard hook 11->131 22 icsys.icn.exe 3 11->22         started        27 lg3gn9y1cj.exe 1 11->27         started        133 Changes security center settings (notifications, updates, antivirus, firewall) 17->133 79 127.0.0.1 unknown unknown 19->79 file5 signatures6 process7 dnsIp8 81 192.168.2.1 unknown unknown 22->81 67 C:\Windows\System\explorer.exe, PE32 22->67 dropped 109 Antivirus detection for dropped file 22->109 111 Machine Learning detection for dropped file 22->111 113 Drops executables to the windows directory (C:\Windows) and starts them 22->113 121 2 other signatures 22->121 29 explorer.exe 3 20 22->29         started        115 Writes to foreign memory regions 27->115 117 Allocates memory in foreign processes 27->117 119 Injects a PE file into a foreign processes 27->119 34 AppLaunch.exe 15 3 27->34         started        file9 signatures10 process11 dnsIp12 83 vccmd01.zxq.net 51.81.194.202, 443, 49764, 49766 OVHFR United States 29->83 85 zxq.net 29->85 91 5 other IPs or domains 29->91 75 C:\Windows\System\spoolsv.exe, PE32 29->75 dropped 77 C:\Users\user\AppData\Roaming\mrsys.exe, PE32 29->77 dropped 137 Antivirus detection for dropped file 29->137 139 System process connects to network (likely due to code injection or exploit) 29->139 141 Creates an undocumented autostart registry key 29->141 149 3 other signatures 29->149 36 spoolsv.exe 2 29->36         started        87 icanhazip.com 104.18.114.97, 49753, 80 CLOUDFLARENETUS United States 34->87 89 64.89.4.0.in-addr.arpa 34->89 143 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->143 145 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 34->145 147 May check the online IP address of the machine 34->147 151 2 other signatures 34->151 file13 signatures14 process15 file16 65 C:\Windows\System\svchost.exe, PE32 36->65 dropped 101 Antivirus detection for dropped file 36->101 103 Machine Learning detection for dropped file 36->103 105 Drops executables to the windows directory (C:\Windows) and starts them 36->105 107 2 other signatures 36->107 40 svchost.exe 3 4 36->40         started        signatures17 process18 file19 69 C:\Users\user\AppData\Local\stsys.exe, PE32 40->69 dropped 123 Antivirus detection for dropped file 40->123 125 Detected CryptOne packer 40->125 127 Machine Learning detection for dropped file 40->127 129 3 other signatures 40->129 44 spoolsv.exe 40->44         started        47 at.exe 40->47         started        49 at.exe 40->49         started        51 17 other processes 40->51 signatures20 process21 signatures22 135 Installs a global keyboard hook 44->135 53 conhost.exe 47->53         started        55 conhost.exe 49->55         started        57 conhost.exe 51->57         started        59 conhost.exe 51->59         started        61 conhost.exe 51->61         started        63 13 other processes 51->63 process23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.18.114.97
 icanhazip.com United States
13335 CLOUDFLARENETUS false
142.250.145.82
 googlecode.l.googleusercontent.com United States
15169 GOOGLEUS false
51.81.194.202
 zxq.net United States
16276 OVHFR true

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
zxq.net 51.81.194.202 true
icanhazip.com 104.18.114.97 true
googlecode.l.googleusercontent.com 142.250.145.82 true
vccmd01.zxq.net 51.81.194.202 true
64.89.4.0.in-addr.arpa unknown unknown
vccmd03.googlecode.com unknown unknown
vccmd01.t35.com unknown unknown
vccmd01.googlecode.com unknown unknown
vccmd02.googlecode.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://vccmd03.googlecode.com/files/cmsys.gif false
  • URL Reputation: safe
 unknown
https://zxq.net/cmsys.gif true
  • Avira URL Cloud: safe
 unknown
https://zxq.net/what-happened-to-the-old-zxq-website/ true
  • Avira URL Cloud: safe
 unknown
http://icanhazip.com/ false
    		high